# Example: Secure Web Application Architecture
// Node.js Express server with security best practices

const express = require('express');
const helmet = require('helmet');
const rateLimit = require('express-rate-limit');
const cors = require('cors');
const session = require('express-session');
const bcrypt = require('bcrypt');
const jwt = require('jsonwebtoken');

const app = express();

// Security middleware
app.use(helmet({
    contentSecurityPolicy: {
        directives: {
            defaultSrc: ["'self'"],
            styleSrc: ["'self'", "'unsafe-inline'"],
            scriptSrc: ["'self'"],
            imgSrc: ["'self'", "data:", "https:"],
            connectSrc: ["'self'"],
            fontSrc: ["'self'"],
            objectSrc: ["'none'"],
            mediaSrc: ["'self'"],
            frameSrc: ["'none'"],
        },
    },
    hsts: {
        maxAge: 31536000,
        includeSubDomains: true,
        preload: true
    },
    noSniff: true,
    xssFilter: true,
    referrerPolicy: { policy: "same-origin" }
}));

// Rate limiting
const limiter = rateLimit({
    windowMs: 15 * 60 * 1000, // 15 minutes
    max: 100, // limit each IP to 100 requests per windowMs
    message: 'Too many requests from this IP, please try again later.'
});
app.use(limiter);

// CORS configuration
app.use(cors({
    origin: process.env.ALLOWED_ORIGINS?.split(',') || ['http://localhost:3000'],
    credentials: true,
    methods: ['GET', 'POST', 'PUT', 'DELETE'],
    allowedHeaders: ['Content-Type', 'Authorization']
}));

// Session configuration
app.use(session({
    secret: process.env.SESSION_SECRET || 'your-secret-key',
    resave: false,
    saveUninitialized: false,
    cookie: {
        secure: process.env.NODE_ENV === 'production',
        httpOnly: true,
        maxAge: 24 * 60 * 60 * 1000 // 24 hours
    }
}));

// Body parsing middleware
app.use(express.json({ limit: '10mb' }));
app.use(express.urlencoded({ extended: true, limit: '10mb' }));

// Input validation middleware
const validateInput = (req, res, next) => {
    const { email, password } = req.body;
    
    // Email validation
    const emailRegex = /^[^s@]+@[^s@]+.[^s@]+$/;
    if (email && !emailRegex.test(email)) {
        return res.status(400).json({ error: 'Invalid email format' });
    }
    
    // Password validation
    if (password && password.length < 8) {
        return res.status(400).json({ error: 'Password must be at least 8 characters' });
    }
    
    next();
};

// Authentication middleware
const authenticateToken = (req, res, next) => {
    const authHeader = req.headers['authorization'];
    const token = authHeader && authHeader.split(' ')[1];
    
    if (!token) {
        return res.status(401).json({ error: 'Access token required' });
    }
    
    jwt.verify(token, process.env.JWT_SECRET, (err, user) => {
        if (err) {
            return res.status(403).json({ error: 'Invalid or expired token' });
        }
        req.user = user;
        next();
    });
};

// Secure routes
app.post('/api/login', validateInput, async (req, res) => {
    try {
        const { email, password } = req.body;
        
        // Simulate user lookup (in real app, query database)
        const user = await findUserByEmail(email);
        if (!user) {
            return res.status(401).json({ error: 'Invalid credentials' });
        }
        
        // Verify password
        const isValidPassword = await bcrypt.compare(password, user.passwordHash);
        if (!isValidPassword) {
            return res.status(401).json({ error: 'Invalid credentials' });
        }
        
        // Generate JWT token
        const token = jwt.sign(
            { userId: user.id, email: user.email },
            process.env.JWT_SECRET,
            { expiresIn: '1h' }
        );
        
        res.json({ token, user: { id: user.id, email: user.email } });
    } catch (error) {
        console.error('Login error:', error);
        res.status(500).json({ error: 'Internal server error' });
    }
});

app.get('/api/protected', authenticateToken, (req, res) => {
    res.json({ message: 'This is a protected route', user: req.user });
});

// Error handling middleware
app.use((err, req, res, next) => {
    console.error(err.stack);
    res.status(500).json({ error: 'Something went wrong!' });
});

// 404 handler
app.use((req, res) => {
    res.status(404).json({ error: 'Route not found' });
});

const PORT = process.env.PORT || 3000;
app.listen(PORT, () => {
    console.log(`Secure web server running on port ${PORT}`);
});

// Security headers for static files
app.use(express.static('public', {
    setHeaders: (res, path) => {
        res.setHeader('X-Content-Type-Options', 'nosniff');
        res.setHeader('X-Frame-Options', 'DENY');
        res.setHeader('X-XSS-Protection', '1; mode=block');
    }
});

# Mini-Project: Web Architecture Security Analysis
// Analyze the security of different web architectures

const webArchitectures = {
    traditional: {
        name: "Traditional LAMP Stack",
        components: ["Linux", "Apache", "MySQL", "PHP"],
        securityLevel: "Medium",
        vulnerabilities: ["SQL Injection", "XSS", "File Upload", "Directory Traversal"],
        strengths: ["Mature", "Well-documented", "Large community"],
        weaknesses: ["Single point of failure", "Limited scalability", "Manual security updates"]
    },
    modern: {
        name: "Modern Microservices",
        components: ["Docker", "Kubernetes", "API Gateway", "Multiple Databases"],
        securityLevel: "High",
        vulnerabilities: ["Container escape", "API abuse", "Service mesh attacks"],
        strengths: ["Scalable", "Fault-tolerant", "Automated security"],
        weaknesses: ["Complex", "More attack surface", "Requires expertise"]
    },
    serverless: {
        name: "Serverless Architecture",
        components: ["AWS Lambda", "API Gateway", "DynamoDB", "CloudFront"],
        securityLevel: "High",
        vulnerabilities: ["Function injection", "Cold start attacks", "Resource exhaustion"],
        strengths: ["Auto-scaling", "Pay-per-use", "Managed security"],
        weaknesses: ["Vendor lock-in", "Cold starts", "Limited control"]
    },
    static: {
        name: "Static Site Generation",
        components: ["JAMstack", "CDN", "Git", "Build Tools"],
        securityLevel: "Very High",
        vulnerabilities: ["Build process attacks", "CDN abuse", "Git vulnerabilities"],
        strengths: ["Fast", "Secure", "Cost-effective"],
        weaknesses: ["Limited functionality", "No server-side processing", "Build complexity"]
    }
};

// Calculate security score for each architecture
function calculateArchitectureScore(arch) {
    let score = 0;
    
    // Security level (40 points)
    const securityScores = {
        "Very High": 40,
        "High": 30,
        "Medium": 20,
        "Low": 10
    };
    score += securityScores[arch.securityLevel] || 0;
    
    // Vulnerability count (30 points)
    const vulnCount = arch.vulnerabilities.length;
    if (vulnCount === 0) score += 30;
    else if (vulnCount <= 2) score += 20;
    else if (vulnCount <= 4) score += 10;
    else if (vulnCount <= 6) score += 5;
    
    // Component count (20 points)
    const componentCount = arch.components.length;
    if (componentCount <= 3) score += 20;
    else if (componentCount <= 5) score += 15;
    else if (componentCount <= 7) score += 10;
    else score += 5;
    
    // Strengths vs weaknesses (10 points)
    const strengthCount = arch.strengths.length;
    const weaknessCount = arch.weaknesses.length;
    const ratio = strengthCount / (strengthCount + weaknessCount);
    score += Math.round(ratio * 10);
    
    return Math.min(score, 100);
}

// Assess each architecture
console.log("WEB ARCHITECTURE SECURITY ANALYSIS");
console.log("==================================");

Object.keys(webArchitectures).forEach(key => {
    const arch = webArchitectures[key];
    const score = calculateArchitectureScore(arch);
    
    console.log(`
${arch.name.toUpperCase()}:`);
    console.log(`  Components: ${arch.components.join(', ')}`);
    console.log(`  Security Level: ${arch.securityLevel}`);
    console.log(`  Security Score: ${score}/100`);
    console.log(`  Vulnerabilities: ${arch.vulnerabilities.join(', ')}`);
    console.log(`  Strengths: ${arch.strengths.join(', ')}`);
    console.log(`  Weaknesses: ${arch.weaknesses.join(', ')}`);
});

// Generate security recommendations
function generateArchitectureRecommendations(architecture) {
    const recommendations = {
        traditional: [
            "Implement Web Application Firewall (WAF)",
            "Use parameterized queries to prevent SQL injection",
            "Enable HTTPS and HSTS",
            "Regular security updates and patches",
            "Implement proper input validation and sanitization"
        ],
        modern: [
            "Use service mesh for secure communication",
            "Implement proper container security scanning",
            "Use secrets management for sensitive data",
            "Implement network policies and segmentation",
            "Regular security audits and penetration testing"
        ],
        serverless: [
            "Implement proper IAM roles and permissions",
            "Use environment variables for configuration",
            "Implement proper error handling and logging",
            "Use API Gateway for rate limiting and authentication",
            "Regular security monitoring and alerting"
        ],
        static: [
            "Use secure build processes and CI/CD",
            "Implement proper CDN security headers",
            "Use secure Git practices and access controls",
            "Regular security audits of dependencies",
            "Implement proper backup and recovery procedures"
        ]
    };
    
    return recommendations[architecture] || ["General security recommendations apply"];
}

console.log("
ARCHITECTURE-SPECIFIC RECOMMENDATIONS:");
Object.keys(webArchitectures).forEach(key => {
    const arch = webArchitectures[key];
    const recommendations = generateArchitectureRecommendations(key);
    
    console.log(`
${arch.name.toUpperCase()} Recommendations:`);
    recommendations.forEach((rec, index) => {
        console.log(`${index + 1}. ${rec}`);
    });
});