🔐 Security Best Practices for Enterprise Applications

const https = require('https');
const fs = require('fs');
const helmet = require('helmet');
const tls = require('tls');

// Advanced TLS Configuration
class SecureTLSConfig {
  constructor() {
    this.tlsOptions = {
      // Certificate and key files
      key: fs.readFileSync(process.env.TLS_PRIVATE_KEY_PATH),
      cert: fs.readFileSync(process.env.TLS_CERTIFICATE_PATH),
      ca: fs.readFileSync(process.env.TLS_CA_PATH), // Certificate Authority
      
      // TLS Version Control
      secureProtocol: 'TLSv1_3_method',
      minVersion: 'TLSv1.2',
      maxVersion: 'TLSv1.3',
      
      // Strong Cipher Suites (ordered by preference)
      ciphers: [
        'ECDHE-RSA-AES256-GCM-SHA384',
        'ECDHE-RSA-AES128-GCM-SHA256',
        'ECDHE-RSA-AES256-SHA384',
        'ECDHE-RSA-AES128-SHA256',
        'DHE-RSA-AES256-GCM-SHA384',
        'DHE-RSA-AES128-GCM-SHA256'
      ].join(':'),
      
      // Security Options
      honorCipherOrder: true, // Server cipher preference
      requestCert: false, // Client certificate validation
      rejectUnauthorized: true,
      
      // Perfect Forward Secrecy
      dhparam: fs.readFileSync('path/to/dhparam.pem'),
      
      // OCSP Stapling
      enableTrace: false,
      
      // Session management
      sessionIdContext: 'secure-app',
      ticketKeys: Buffer.from(process.env.TLS_TICKET_KEYS, 'hex')
    };
  }

  // Create secure HTTPS server
  createSecureServer(app) {
    const server = https.createServer(this.tlsOptions, app);
    
    // TLS event handlers
    server.on('secureConnection', (tlsSocket) => {
      console.log('Secure connection established:', {
        protocol: tlsSocket.getProtocol(),
        cipher: tlsSocket.getCipher(),
        authorized: tlsSocket.authorized,
        peerCertificate: tlsSocket.getPeerCertificate()
      });
    });

    server.on('tlsClientError', (err, tlsSocket) => {
      console.error('TLS Client Error:', err.message);
      // Log potential attack attempts
      this.logSecurityEvent('tls_client_error', {
        error: err.message,
        remoteAddress: tlsSocket.remoteAddress
      });
    });

    return server;
  }

  // Certificate validation and monitoring
  async validateCertificates() {
    const cert = fs.readFileSync(process.env.TLS_CERTIFICATE_PATH);
    const certInfo = tls.parseCertString(cert.toString());
    
    const expiryDate = new Date(certInfo.validTo);
    const daysUntilExpiry = Math.ceil((expiryDate - new Date()) / (1000 * 60 * 60 * 24));
    
    if (daysUntilExpiry < 30) {
      await this.alertCertificateExpiry(daysUntilExpiry);
    }
    
    return {
      valid: daysUntilExpiry > 0,
      daysUntilExpiry,
      issuer: certInfo.issuer,
      subject: certInfo.subject
    };
  }

  async alertCertificateExpiry(days) {
    console.warn(`Certificate expires in ${days} days!`);
    // Implement alerting mechanism (email, Slack, etc.)
  }

  logSecurityEvent(eventType, details) {
    console.warn('Security Event:', {
      type: eventType,
      timestamp: new Date().toISOString(),
      details
    });
  }
}

// Enhanced security headers with Helmet
const configureSecurityHeaders = () => {
  return helmet({
    // Content Security Policy
    contentSecurityPolicy: {
      directives: {
        defaultSrc: ["'self'"],
        scriptSrc: ["'self'", "'nonce-{NONCE}'"],
        styleSrc: ["'self'", "'unsafe-inline'"],
        imgSrc: ["'self'", "data:", "https:"],
        connectSrc: ["'self'", "https://api.yourdomain.com"],
        fontSrc: ["'self'", "https://fonts.gstatic.com"],
        objectSrc: ["'none'"],
        mediaSrc: ["'self'"],
        frameSrc: ["'none'"],
        childSrc: ["'none'"],
        workerSrc: ["'self'"],
        frameAncestors: ["'none'"],
        upgradeInsecureRequests: []
      },
      reportUri: '/csp-report'
    },
    
    // HTTP Strict Transport Security (HSTS)
    hsts: {
      maxAge: 63072000, // 2 years
      includeSubDomains: true,
      preload: true
    },
    
    // X-Frame-Options
    frameguard: {
      action: 'deny'
    },
    
    // X-Content-Type-Options
    noSniff: true,
    
    // X-XSS-Protection
    xssFilter: true,
    
    // Referrer Policy
    referrerPolicy: {
      policy: 'strict-origin-when-cross-origin'
    },
    
    // Permissions Policy
    permissionsPolicy: {
      features: {
        accelerometer: [],
        camera: [],
        geolocation: [],
        gyroscope: [],
        magnetometer: [],
        microphone: [],
        payment: [],
        usb: []
      }
    },
    
    // Hide X-Powered-By header
    hidePoweredBy: true,
    
    // DNS Prefetch Control
    dnsPrefetchControl: {
      allow: false
    }
  });
};

// Usage
const tlsConfig = new SecureTLSConfig();
const app = express();

app.use(configureSecurityHeaders());

const server = tlsConfig.createSecureServer(app);
server.listen(443, () => {
  console.log('Secure HTTPS server running on port 443');
  tlsConfig.validateCertificates();
});

const cors = require('cors');

class EnterpriseCORSManager {
  constructor() {
    this.allowedOrigins = new Set([
      'https://yourdomain.com',
      'https://app.yourdomain.com',
      'https://admin.yourdomain.com',
      'https://api.yourdomain.com'
    ]);
    
    this.dynamicOrigins = new Map(); // For partner integrations
    this.corsMetrics = {
      allowed: 0,
      blocked: 0,
      errors: 0
    };
  }

  // Dynamic origin management for partner APIs
  addTrustedOrigin(origin, metadata = {}) {
    this.dynamicOrigins.set(origin, {
      ...metadata,
      addedAt: new Date(),
      requestCount: 0
    });
  }

  removeTrustedOrigin(origin) {
    return this.dynamicOrigins.delete(origin);
  }

  // Advanced origin validation
  validateOrigin(origin, callback) {
    // Allow requests with no origin (mobile apps, Postman, etc.)
    if (!origin) {
      this.corsMetrics.allowed++;
      return callback(null, true);
    }

    // Check static allowed origins
    if (this.allowedOrigins.has(origin)) {
      this.corsMetrics.allowed++;
      return callback(null, true);
    }

    // Check dynamic origins (partner integrations)
    if (this.dynamicOrigins.has(origin)) {
      const originData = this.dynamicOrigins.get(origin);
      originData.requestCount++;
      originData.lastUsed = new Date();
      
      this.corsMetrics.allowed++;
      return callback(null, true);
    }

    // Log blocked origin for analysis
    this.logBlockedOrigin(origin);
    this.corsMetrics.blocked++;
    
    callback(new Error(`Origin ${origin} not allowed by CORS policy`));
  }

  // Environment-specific CORS configuration
  getCORSOptions(environment = 'production') {
    const baseOptions = {
      origin: (origin, callback) => this.validateOrigin(origin, callback),
      credentials: true,
      optionsSuccessStatus: 200,
      maxAge: 86400, // 24 hours preflight cache
      
      // Allowed methods
      methods: ['GET', 'POST', 'PUT', 'DELETE', 'PATCH', 'OPTIONS'],
      
      // Allowed headers
      allowedHeaders: [
        'Origin',
        'X-Requested-With',
        'Content-Type',
        'Accept',
        'Authorization',
        'X-API-Key',
        'X-Client-Version',
        'X-Request-ID'
      ],
      
      // Exposed headers
      exposedHeaders: [
        'X-Total-Count',
        'X-Rate-Limit-Remaining',
        'X-Rate-Limit-Reset',
        'X-Request-ID'
      ]
    };

    // Environment-specific overrides
    if (environment === 'development') {
      baseOptions.origin = true; // Allow all origins in development
      baseOptions.maxAge = 0; // Disable preflight caching
    } else if (environment === 'testing') {
      baseOptions.origin = /^https?:\/\/localhost(:\d+)?$/;
    }

    return baseOptions;
  }

  // CORS monitoring and analytics
  getCORSMetrics() {
    return {
      ...this.corsMetrics,
      allowedOrigins: Array.from(this.allowedOrigins),
      dynamicOrigins: Array.from(this.dynamicOrigins.keys()),
      totalRequests: this.corsMetrics.allowed + this.corsMetrics.blocked
    };
  }

  logBlockedOrigin(origin) {
    console.warn('CORS: Blocked origin', {
      origin,
      timestamp: new Date().toISOString(),
      userAgent: this.currentRequest?.get('User-Agent'),
      ip: this.currentRequest?.ip
    });
  }
}

// Usage with Express
const corsManager = new EnterpriseCORSManager();

// Add partner origins dynamically
corsManager.addTrustedOrigin('https://partner1.com', {
  partner: 'Partner One',
  apiKey: 'partner1_key',
  permissions: ['read']
});

const corsOptions = corsManager.getCORSOptions(process.env.NODE_ENV);

app.use(cors(corsOptions));

// CORS metrics endpoint
app.get('/api/admin/cors-metrics', (req, res) => {
  res.json(corsManager.getCORSMetrics());
});

const rateLimit = require('express-rate-limit');
const slowDown = require('express-slow-down');
const MongoStore = require('rate-limit-mongo');

class ApplicationFirewall {
  constructor() {
    this.blacklistedIPs = new Set();
    this.whitelistedIPs = new Set([
      '127.0.0.1',
      '::1',
      '10.0.0.0/8',
      '172.16.0.0/12',
      '192.168.0.0/16'
    ]);
    
    
    
    this.geoBlockedCountries = new Set(['CN', 'RU', 'KP']);
  }

  // IP-based access control
  ipAccessControl() {
    return (req, res, next) => {
      const clientIP = this.getClientIP(req);
      
      // Check whitelist first
      if (this.isIPWhitelisted(clientIP)) {
        return next();
      }
      
      // Check blacklist
      if (this.blacklistedIPs.has(clientIP)) {
        this.logSecurityEvent('blocked_ip_access', {
          ip: clientIP,
          reason: 'blacklisted'
        });
        
        return res.status(403).json({
          error: 'Access denied',
          code: 'IP_BLOCKED'
        });
      }
      
      next();
    };
  }

  // Geographic blocking
  geoBlockMiddleware() {
    return async (req, res, next) => {
      const clientIP = this.getClientIP(req);
      const country = await this.getCountryFromIP(clientIP);
      
      if (this.geoBlockedCountries.has(country)) {
        this.logSecurityEvent('geo_blocked_access', {
          ip: clientIP,
          country,
          userAgent: req.get('User-Agent')
        });
        
        return res.status(403).json({
          error: 'Access denied from your location',
          code: 'GEO_BLOCKED'
        });
      }
      
      next();
    };
  }

  // SQL injection and XSS protection
  maliciousRequestDetection() {
    return (req, res, next) => {
      const suspiciousData = [
        JSON.stringify(req.query),
        JSON.stringify(req.body),
        JSON.stringify(req.params),
        req.get('User-Agent') || '',
        req.get('Referer') || ''
      ].join(' ');

      for (const pattern of this.suspiciousPatterns) {
        if (pattern.test(suspiciousData)) {
          this.logSecurityEvent('malicious_request_detected', {
            ip: this.getClientIP(req),
            pattern: pattern.toString(),
            url: req.originalUrl,
            method: req.method,
            userAgent: req.get('User-Agent'),
            suspiciousData: suspiciousData.substring(0, 1000)
          });
          
          // Temporarily blacklist the IP
          this.temporaryBlacklist(this.getClientIP(req), 3600000); // 1 hour
          
          return res.status(400).json({
            error: 'Malicious request detected',
            code: 'MALICIOUS_REQUEST'
          });
        }
      }
      
      next();
    };
  }

  // Advanced DDoS protection with adaptive thresholds
  createDDoSProtection() {
    // Progressive rate limiting
    const createRateLimiter = (windowMs, max, skipSuccessfulRequests = false) => {
      return rateLimit({
        store: new MongoStore({
          uri: process.env.MONGODB_URI,
          collectionName: 'rateLimits',
          expireTimeMs: windowMs
        }),
        windowMs,
        max,
        skipSuccessfulRequests,
        standardHeaders: true,
        legacyHeaders: false,
        
        // Custom key generator (IP + User-Agent fingerprint)
        keyGenerator: (req) => {
          const ip = this.getClientIP(req);
          const userAgent = req.get('User-Agent') || '';
          const fingerprint = this.createFingerprint(userAgent);
          return `${ip}:${fingerprint}`;
        },
        
        // Dynamic response based on violation severity
        handler: (req, res) => {
          const clientIP = this.getClientIP(req);
          this.incrementViolationCount(clientIP);
          
          const violations = this.getViolationCount(clientIP);
          
          if (violations > 10) {
            this.temporaryBlacklist(clientIP, 3600000); // 1 hour blacklist
          }
          
          res.status(429).json({
            error: 'Too many requests',
            retryAfter: Math.ceil(windowMs / 1000),
            violations
          });
        }
      });
    };

    // Progressive slowdown for suspicious behavior
    const createSlowDown = (windowMs, delayAfter, delayMs) => {
      return slowDown({
        windowMs,
        delayAfter,
        delayMs,
        skipSuccessfulRequests: true,
        
        keyGenerator: (req) => {
          return this.getClientIP(req);
        }
      });
    };

    return {
      // General API protection
      general: createRateLimiter(15 * 60 * 1000, 1000), // 1000 requests per 15 minutes
      
      // Authentication endpoints (stricter)
      auth: createRateLimiter(15 * 60 * 1000, 10, true), // 10 attempts per 15 minutes
      
      // File upload endpoints
      upload: createRateLimiter(60 * 60 * 1000, 50), // 50 uploads per hour
      
      // Progressive slowdown
      slowDown: createSlowDown(15 * 60 * 1000, 100, 500), // Slow down after 100 requests
      
      // Burst protection
      burst: createRateLimiter(60 * 1000, 50) // 50 requests per minute
    };
  }

  // Utility methods
  getClientIP(req) {
    return req.ip || 
           req.connection?.remoteAddress || 
           req.socket?.remoteAddress ||
           (req.headers['x-forwarded-for'] || '').split(',')[0].trim() ||
           req.headers['x-real-ip'] ||
           'unknown';
  }

  isIPWhitelisted(ip) {
    for (const whitelistedIP of this.whitelistedIPs) {
      if (this.isIPInRange(ip, whitelistedIP)) {
        return true;
      }
    }
    return false;
  }

  isIPInRange(ip, range) {
    // Simplified CIDR check - implement proper CIDR matching in production
    if (!range.includes('/')) {
      return ip === range;
    }
    // Implement proper CIDR matching logic
    return false;
  }

  createFingerprint(userAgent) {
    const crypto = require('crypto');
    return crypto.createHash('md5').update(userAgent).digest('hex').substring(0, 8);
  }

  temporaryBlacklist(ip, duration) {
    this.blacklistedIPs.add(ip);
    setTimeout(() => {
      this.blacklistedIPs.delete(ip);
    }, duration);
    
    this.logSecurityEvent('ip_temporarily_blacklisted', {
      ip,
      duration,
      timestamp: new Date().toISOString()
    });
  }

  incrementViolationCount(ip) {
    // Implementation depends on your storage solution
    // Could use Redis, MongoDB, or in-memory store
  }

  getViolationCount(ip) {
    // Implementation depends on your storage solution
    return 0;
  }

  async getCountryFromIP(ip) {
    // Implement using a service like MaxMind GeoIP
    // This is a placeholder
    return 'US';
  }

  logSecurityEvent(type, details) {
    console.warn('Security Event:', {
      type,
      timestamp: new Date().toISOString(),
      details
    });
  }
}

// Usage
const firewall = new ApplicationFirewall();
const ddosProtection = firewall.createDDoSProtection();

// Apply firewall middleware
app.use(firewall.ipAccessControl());
app.use(firewall.geoBlockMiddleware());
app.use(firewall.maliciousRequestDetection());

// Apply DDoS protection
app.use('/api/', ddosProtection.general);
app.use('/api/auth/', ddosProtection.auth);
app.use('/api/upload/', ddosProtection.upload);
app.use(ddosProtection.slowDown);

class ZeroTrustNetworkManager {
  constructor() {
    this.networkZones = {
      public: { trust: 0, color: 'red' },
      dmz: { trust: 25, color: 'orange' },
      internal: { trust: 50, color: 'yellow' },
      secure: { trust: 75, color: 'blue' },
      critical: { trust: 100, color: 'green' }
    };
    
    this.accessPolicies = new Map();
    this.deviceRegistry = new Map();
    this.riskScores = new Map();
  }

  // Device registration and trust scoring
  registerDevice(deviceId, metadata) {
    const device = {
      id: deviceId,
      ...metadata,
      registered: new Date(),
      lastSeen: new Date(),
      trustScore: this.calculateInitialTrustScore(metadata),
      accessHistory: []
    };
    
    this.deviceRegistry.set(deviceId, device);
    return device;
  }

  calculateInitialTrustScore(metadata) {
    let score = 50; // Base score
    
    // Factor in device type
    if (metadata.managed) score += 20;
    if (metadata.encrypted) score += 15;
    if (metadata.patchLevel === 'current') score += 10;
    if (metadata.antivirus) score += 5;
    
    return Math.min(100, score);
  }

  // Dynamic risk assessment
  assessRequestRisk(req) {
    const factors = {
      deviceTrust: this.getDeviceTrustScore(req),
      geolocation: this.assessGeolocationRisk(req),
      behavior: this.assessBehaviorRisk(req),
      network: this.assessNetworkRisk(req),
      time: this.assessTimeRisk(req)
    };
    
    const weights = {
      deviceTrust: 0.3,
      geolocation: 0.2,
      behavior: 0.25,
      network: 0.15,
      time: 0.1
    };
    
    const riskScore = Object.keys(factors).reduce((total, factor) => {
      return total + (factors[factor] * weights[factor]);
    }, 0);
    
    return {
      score: Math.round(riskScore),
      factors,
      level: this.getRiskLevel(riskScore)
    };
  }

  // Adaptive access control
  createAdaptiveAccessMiddleware() {
    return async (req, res, next) => {
      const risk = this.assessRequestRisk(req);
      const requiredTrustLevel = this.getRequiredTrustLevel(req.path);
      
      // Log access attempt
      this.logAccessAttempt(req, risk);
      
      if (risk.level === 'high' && requiredTrustLevel > 50) {
        // Require additional authentication
        return this.requireStepUpAuth(req, res, next);
      }
      
      if (risk.level === 'critical') {
        // Block access and alert
        this.triggerSecurityAlert('critical_risk_access', { req, risk });
        return res.status(403).json({
          error: 'Access denied due to high risk',
          riskLevel: risk.level,
          factors: risk.factors
        });
      }
      
      // Update device trust based on successful access
      this.updateDeviceTrust(req, 'successful_access');
      next();
    };
  }

  // Micro-segmentation implementation
  createMicroSegmentationRules() {
    return {
      // Database access - only from application servers
      database: {
        allowedSources: ['app-server-subnet'],
        deniedSources: ['public', 'dmz'],
        ports: [5432, 3306, 27017],
        encryption: 'required'
      },
      
      // API servers - controlled external access
      api: {
        allowedSources: ['dmz', 'internal'],
        ports: [80, 443],
        rateLimiting: true,
        encryption: 'required'
      },
      
      // Internal services - no external access
      internal: {
        allowedSources: ['internal', 'secure'],
        deniedSources: ['public', 'dmz'],
        ports: [8080, 9090],
        encryption: 'preferred'
      },
      
      // Admin interfaces - highly restricted
      admin: {
        allowedSources: ['secure'],
        requiresMFA: true,
        timeRestrictions: '09:00-17:00',
        encryption: 'required',
        logging: 'verbose'
      }
    };
  }

  // Network monitoring and anomaly detection
  startNetworkMonitoring() {
    setInterval(() => {
      this.analyzeTrafficPatterns();
      this.detectAnomalies();
      this.updateThreatIntelligence();
    }, 60000); // Every minute
  }

  analyzeTrafficPatterns() {
    // Implementation would analyze:
    // - Connection volumes and patterns
    // - Protocol usage anomalies
    // - Unusual port activities
    // - Geographic distribution changes
    
    const patterns = this.getCurrentTrafficPatterns();
    const anomalies = this.compareWithBaseline(patterns);
    
    if (anomalies.length > 0) {
      this.investigateAnomalies(anomalies);
    }
  }

  detectAnomalies() {
    // Machine learning-based anomaly detection
    const currentMetrics = this.collectNetworkMetrics();
    const anomalies = this.mlAnomalyDetection(currentMetrics);
    
    anomalies.forEach(anomaly => {
      this.handleAnomaly(anomaly);
    });
  }

  // Utility methods
  getDeviceTrustScore(req) {
    const deviceId = req.headers['x-device-id'];
    const device = this.deviceRegistry.get(deviceId);
    return device ? device.trustScore : 0;
  }

  assessGeolocationRisk(req) {
    const ip = req.ip;
    const location = this.getIPLocation(ip);
    
    // Higher risk for unexpected locations
    if (this.isHighRiskCountry(location.country)) return 80;
    if (this.isNewLocation(req.user?.id, location)) return 60;
    return 20;
  }

  assessBehaviorRisk(req) {
    const userId = req.user?.id;
    if (!userId) return 50;
    
    const recentBehavior = this.getUserRecentBehavior(userId);
    return this.analyzeBehaviorDeviation(recentBehavior);
  }

  requireStepUpAuth(req, res, next) {
    res.status(403).json({
      error: 'Additional authentication required',
      challenge: 'mfa',
      methods: ['totp', 'sms', 'push']
    });
  }

  triggerSecurityAlert(type, data) {
    console.error('Security Alert:', {
      type,
      timestamp: new Date().toISOString(),
      data
    });
    
    // Implement alerting system (email, Slack, PagerDuty, etc.)
  }

  logAccessAttempt(req, risk) {
    const log = {
      timestamp: new Date().toISOString(),
      ip: req.ip,
      userId: req.user?.id,
      path: req.path,
      method: req.method,
      userAgent: req.get('User-Agent'),
      riskScore: risk.score,
      riskLevel: risk.level,
      riskFactors: risk.factors
    };
    
    // Store in security log database
    console.log('Access Log:', log);
  }
}

// Usage
const zeroTrust = new ZeroTrustNetworkManager();

// Apply zero trust middleware
app.use(zeroTrust.createAdaptiveAccessMiddleware());

// Start monitoring
zeroTrust.startNetworkMonitoring();

// Configure micro-segmentation rules
const segmentationRules = zeroTrust.createMicroSegmentationRules();
console.log('Micro-segmentation rules configured:', segmentationRules);

const EventEmitter = require('events');

class NetworkSecurityMonitor extends EventEmitter {
  constructor() {
    super();
    this.metrics = {
      connections: 0,
      bytesTransferred: 0,
      requestsPerSecond: 0,
      errorRate: 0,
      suspiciousActivities: 0
    };
    
    this.alerts = [];
    this.thresholds = {
      maxConnectionsPerMinute: 1000,
      maxErrorRatePercent: 5,
      maxRequestsPerSecond: 100,
      suspiciousPatternThreshold: 10
    };
    
    this.trafficBaseline = this.loadTrafficBaseline();
    this.startRealTimeMonitoring();
  }

  startRealTimeMonitoring() {
    // Monitor every 10 seconds
    setInterval(() => {
      this.collectMetrics();
      this.analyzeMetrics();
      this.checkThresholds();
    }, 10000);
    
    // Detailed analysis every minute
    setInterval(() => {
      this.performDetailedAnalysis();
    }, 60000);
  }

  // Real-time metrics collection
  collectMetrics() {
    const currentTime = Date.now();
    
    // Collect system metrics
    this.metrics.cpuUsage = process.cpuUsage();
    this.metrics.memoryUsage = process.memoryUsage();
    this.metrics.timestamp = currentTime;
    
    // Network-specific metrics would be collected here
    // This would typically integrate with network monitoring tools
  }

  // Intrusion detection patterns
  detectIntrusionPatterns(req) {
    const patterns = {
      sqlInjection: this.detectSQLInjection(req),
      xssAttempt: this.detectXSSAttempt(req),
      pathTraversal: this.detectPathTraversal(req),
      bruteForce: this.detectBruteForce(req),
      scanningBehavior: this.detectPortScanning(req),
      ddosPattern: this.detectDDoSPattern(req)
    };
    
    const detectedPatterns = Object.keys(patterns).filter(key => patterns[key]);
    
    if (detectedPatterns.length > 0) {
      this.handleIntrusionDetection(req, detectedPatterns);
    }
    
    return detectedPatterns;
  }

  detectSQLInjection(req) {
    const sqlPatterns = [
      /(\bUNION\b|\bSELECT\b|\bINSERT\b|\bDROP\b|\bDELETE\b)/gi,
      /(\bOR\b|\bAND\b)\s+\d+\s*=\s*\d+/gi,
      /'\s*(OR|AND)\s+'[^']*'/gi,
      /;\s*(DROP|DELETE|INSERT|UPDATE)/gi
    ];
    
    const requestData = JSON.stringify({
      query: req.query,
      body: req.body,
      params: req.params
    });
    
    return sqlPatterns.some(pattern => pattern.test(requestData));
  }

  detectXSSAttempt(req) {
    
    const requestData = JSON.stringify(req.body) + JSON.stringify(req.query);
    return xssPatterns.some(pattern => pattern.test(requestData));
  }

  detectPathTraversal(req) {
    const pathPatterns = [
      /\.\.\//g,
      /\.\.\\+/g,
      /%2e%2e%2f/gi,
      /%252e%252e%252f/gi
    ];
    
    const url = req.originalUrl;
    return pathPatterns.some(pattern => pattern.test(url));
  }

  detectBruteForce(req) {
    const ip = req.ip;
    const endpoint = req.path;
    
    // Check for repeated failed attempts
    const failedAttempts = this.getFailedAttempts(ip, endpoint);
    
    return failedAttempts > 10; // Threshold for brute force
  }

  // Enhanced monitoring middleware
  createMonitoringMiddleware() {
    return (req, res, next) => {
      const startTime = Date.now();
      
      // Detect intrusion patterns
      const detectedPatterns = this.detectIntrusionPatterns(req);
      
      if (detectedPatterns.length > 0) {
        this.logSecurityIncident('intrusion_detected', {
          ip: req.ip,
          patterns: detectedPatterns,
          url: req.originalUrl,
          method: req.method,
          userAgent: req.get('User-Agent')
        });
      }
      
      // Monitor response
      res.on('finish', () => {
        const responseTime = Date.now() - startTime;
        
        this.recordRequest({
          ip: req.ip,
          method: req.method,
          url: req.originalUrl,
          statusCode: res.statusCode,
          responseTime,
          userAgent: req.get('User-Agent'),
          timestamp: new Date()
        });
        
        // Update metrics
        this.updateMetrics(req, res, responseTime);
      });
      
      next();
    };
  }

  // Security incident handling
  handleIntrusionDetection(req, patterns) {
    const incident = {
      id: this.generateIncidentId(),
      timestamp: new Date(),
      severity: this.calculateSeverity(patterns),
      source: req.ip,
      patterns,
      request: {
        method: req.method,
        url: req.originalUrl,
        headers: req.headers,
        body: req.body
      }
    };
    
    this.emit('security-incident', incident);
    
    // Auto-response based on severity
    if (incident.severity >= 8) {
      this.autoBlockIP(req.ip, 3600000); // 1 hour block
    }
    
    return incident;
  }

  // Performance and availability monitoring
  monitorPerformance() {
    return setInterval(() => {
      const metrics = {
        avgResponseTime: this.calculateAverageResponseTime(),
        errorRate: this.calculateErrorRate(),
        throughput: this.calculateThroughput(),
        availability: this.calculateAvailability()
      };
      
      // Check for performance anomalies
      if (metrics.avgResponseTime > 5000) { // 5 seconds
        this.triggerAlert('high_response_time', metrics);
      }
      
      if (metrics.errorRate > 0.05) { // 5% error rate
        this.triggerAlert('high_error_rate', metrics);
      }
      
      this.emit('performance-metrics', metrics);
    }, 30000); // Every 30 seconds
  }

  // Alert management
  triggerAlert(type, data) {
    const alert = {
      id: this.generateAlertId(),
      type,
      severity: this.getAlertSeverity(type),
      timestamp: new Date(),
      data,
      acknowledged: false
    };
    
    this.alerts.push(alert);
    this.emit('security-alert', alert);
    
    // Send notifications based on severity
    if (alert.severity >= 7) {
      this.sendEmergencyNotification(alert);
    }
    
    return alert;
  }

  // Utility methods
  logSecurityIncident(type, details) {
    console.warn('Security Incident:', {
      type,
      timestamp: new Date().toISOString(),
      details
    });
  }

  generateIncidentId() {
    return `INC-${Date.now()}-${Math.random().toString(36).substr(2, 9)}`;
  }

  calculateSeverity(patterns) {
    const severityMap = {
      sqlInjection: 9,
      xssAttempt: 7,
      pathTraversal: 8,
      bruteForce: 6,
      scanningBehavior: 5,
      ddosPattern: 10
    };
    
    return Math.max(...patterns.map(p => severityMap[p] || 1));
  }
}

// Usage
const monitor = new NetworkSecurityMonitor();

// Apply monitoring middleware
app.use(monitor.createMonitoringMiddleware());

// Start performance monitoring
monitor.monitorPerformance();

// Event handlers
monitor.on('security-incident', (incident) => {
  console.error('Security Incident Detected:', incident);
  // Implement incident response procedures
});

monitor.on('security-alert', (alert) => {
  console.warn('Security Alert:', alert);
  // Implement alerting system
});

monitor.on('performance-metrics', (metrics) => {
  console.log('Performance Metrics:', metrics);
  // Store metrics for analysis and reporting
});

class NetworkComplianceManager {
  constructor() {
    this.complianceStandards = {
      'PCI-DSS': {
        requirements: [
          'secure_network_config',
          'encryption_in_transit',
          'access_controls',
          'network_monitoring',
          'regular_testing'
        ]
      },
      'SOC2': {
        requirements: [
          'logical_access_controls',
          'network_segmentation',
          'encryption',
          'monitoring_logging',
          'incident_response'
        ]
      },
      'ISO27001': {
        requirements: [
          'network_access_control',
          'network_security_management',
          'network_segregation',
          'cryptographic_controls'
        ]
      }
    };
    
    this.auditLog = [];
    this.complianceStatus = new Map();
  }

  // Automated compliance checking
  performComplianceCheck(standard) {
    const requirements = this.complianceStandards[standard]?.requirements || [];
    const results = {};
    
    requirements.forEach(requirement => {
      results[requirement] = this.checkRequirement(requirement);
    });
    
    const overallCompliance = this.calculateComplianceScore(results);
    
    this.complianceStatus.set(standard, {
      timestamp: new Date(),
      results,
      score: overallCompliance,
      status: overallCompliance >= 0.95 ? 'compliant' : 'non-compliant'
    });
    
    return this.complianceStatus.get(standard);
  }

  // Generate compliance reports
  generateComplianceReport(standard, format = 'json') {
    const compliance = this.complianceStatus.get(standard);
    
    if (!compliance) {
      throw new Error(`No compliance data available for ${standard}`);
    }
    
    const report = {
      standard,
      assessmentDate: compliance.timestamp,
      overallScore: compliance.score,
      status: compliance.status,
      requirements: compliance.results,
      recommendations: this.generateRecommendations(compliance.results),
      nextAssessment: this.calculateNextAssessmentDate()
    };
    
    if (format === 'pdf') {
      return this.generatePDFReport(report);
    }
    
    return report;
  }

  checkRequirement(requirement) {
    // Implementation would check actual system configuration
    // This is a simplified example
    const checks = {
      secure_network_config: () => this.checkNetworkConfiguration(),
      encryption_in_transit: () => this.checkEncryptionInTransit(),
      access_controls: () => this.checkAccessControls(),
      network_monitoring: () => this.checkNetworkMonitoring(),
      network_segmentation: () => this.checkNetworkSegmentation()
    };
    
    const checkFunction = checks[requirement];
    return checkFunction ? checkFunction() : { status: 'unknown', details: 'Check not implemented' };
  }

  checkNetworkConfiguration() {
    // Verify firewall rules, port configurations, etc.
    return {
      status: 'compliant',
      details: 'Network configuration meets security requirements',
      evidence: 'Firewall rules audit completed'
    };
  }

  checkEncryptionInTransit() {
    // Verify TLS configuration, cipher suites, etc.
    return {
      status: 'compliant',
      details: 'All communications encrypted with TLS 1.2+',
      evidence: 'TLS configuration scan completed'
    };
  }
}

🔐 Network Security Checklist

• ✅ Configure strong TLS/SSL with modern cipher suites
• ✅ Implement comprehensive firewall rules (deny by default)
• ✅ Set up network segmentation and micro-segmentation
• ✅ Deploy DDoS protection and rate limiting
• ✅ Configure intrusion detection/prevention systems
• ✅ Implement zero-trust network architecture
• ✅ Set up real-time network monitoring
• ✅ Configure geo-blocking for high-risk regions
• ✅ Implement network access control (NAC)
• ✅ Regular security audits and penetration testing
• ✅ Monitor and log all network activities
• ✅ Maintain compliance with industry standards

🔐 Authentication & Authorization (Auth0)

• ✅ Configure custom domain for branding and security
• ✅ Enable attack protection (brute force, anomaly detection)
• ✅ Implement comprehensive RBAC with permissions
• ✅ Configure multi-factor authentication (MFA)
• ✅ Set up security monitoring and alerting
• ✅ Configure appropriate token lifetimes
• ✅ Implement proper session management
• ✅ Set up compliance features (GDPR, etc.)

🛡️ API Security

• ✅ Use HTTPS/TLS for all communications
• ✅ Validate and sanitize all inputs
• ✅ Implement rate limiting and DDoS protection
• ✅ Use parameterized queries to prevent SQL injection
• ✅ Implement comprehensive logging and monitoring
• ✅ Add security headers to all responses
• ✅ Implement proper CORS configuration

🌐 Network Security

• ✅ Configure firewalls and intrusion detection
• ✅ Use VPNs for secure remote access
• ✅ Regular security audits and penetration testing
• ✅ Network segmentation and access controls
• ✅ Monitor network traffic for anomalies

💻 Secure Coding

• ✅ Store secrets securely (not in code)
• ✅ Keep dependencies updated
• ✅ Use security headers (CSP, HSTS, etc.)
• ✅ Implement proper error handling
• ✅ Regular code security reviews
• ✅ Follow OWASP security guidelines