security

type CSRFConfig struct {
	// Token length in bytes
	TokenLength int

	// Cookie settings
	CookieName     string
	CookiePath     string
	CookieDomain   string
	CookieSecure   bool
	CookieHttpOnly bool
	CookieSameSite http.SameSite
	CookieMaxAge   int

	// Request header name for CSRF token
	RequestHeader string

	// Form field name for CSRF token
	FormField string

	// Paths to exempt from CSRF protection
	ExemptPaths []string

	// Path patterns to exempt (supports wildcards)
	ExemptGlobs []string

	// Methods to exempt from CSRF protection
	ExemptMethods []string

	// Custom failure handler
	FailureHandler http.Handler
}

type CSRFTokenHelper struct {
	// contains filtered or unexported fields
}

type Config struct {
	// Environment
	Environment string // development, staging, production

	// Rate limiting
	RateLimit RateLimitConfig

	// Security headers
	Headers SecurityConfig

	// CSRF protection
	CSRF CSRFConfig

	// IP throttling
	Throttle ThrottleConfig

	// General security settings
	EnableRateLimit  bool
	EnableHeaders    bool
	EnableCSRF       bool
	EnableThrottling bool
	EnableCORS       bool
	EnableIPFilter   bool

	// Request limits
	MaxRequestSize int64         // Maximum request body size
	RequestTimeout time.Duration // Request timeout

	// IP filtering
	TrustedProxies []string
	BlockedIPs     []string
	AllowedIPs     []string

	// API security
	APIKeyRequired bool
	APIKeyHeader   string
}

type IPThrottler struct {
	// contains filtered or unexported fields
}

type InputValidationConfig struct {
	MaxFieldLength  int
	MaxTotalLength  int
	AllowHTML       bool
	StrictMode      bool
	CustomPatterns  map[string]*regexp.Regexp
	BlockedPatterns []*regexp.Regexp
	ExemptPaths     []string
	ExemptMethods   []string
}

type InputValidator struct {
	// contains filtered or unexported fields
}

type RateLimitConfig struct {
	RequestsPerMinute int           // Number of requests per minute
	BurstSize         int           // Burst allowance
	WindowSize        time.Duration // Time window for rate limiting
	SkipSuccessful    bool          // Only count failed requests (4xx, 5xx)
	SkipPaths         []string      // Paths to skip rate limiting
}

type SecurityConfig struct {
	// Content Security Policy
	ContentSecurityPolicy string

	// HSTS settings
	HSTSMaxAge            int
	HSTSIncludeSubdomains bool
	HSTSPreload           bool

	// Frame options
	FrameOptions string // DENY, SAMEORIGIN, or ALLOW-FROM uri

	// Content type options
	ContentTypeNosniff bool

	// XSS Protection
	XSSProtection     bool
	XSSProtectionMode string // block, report=uri

	// Referrer Policy
	ReferrerPolicy string

	// Permissions Policy
	PermissionsPolicy string

	// CORS settings
	AllowedOrigins     []string
	AllowedMethods     []string
	AllowedHeaders     []string
	AllowedCredentials bool
	MaxAge             int

	// Custom headers
	CustomHeaders map[string]string
}

type SecurityEvent struct {
	Timestamp  time.Time              `json:"timestamp"`
	EventType  SecurityEventType      `json:"event_type"`
	Severity   string                 `json:"severity"` // low, medium, high, critical
	ClientIP   string                 `json:"client_ip"`
	UserAgent  string                 `json:"user_agent"`
	RequestURI string                 `json:"request_uri"`
	Method     string                 `json:"method"`
	Headers    map[string]string      `json:"headers,omitempty"`
	UserID     string                 `json:"user_id,omitempty"`
	Message    string                 `json:"message"`
	Details    map[string]interface{} `json:"details,omitempty"`
	Action     string                 `json:"action"` // blocked, allowed, monitored
}

type SecurityEventType string

type SecurityLogger struct {
	// contains filtered or unexported fields
}

type SecurityMonitor struct {
	// contains filtered or unexported fields
}

type ThreatDetails struct {
	Field      string
	ThreatType string
	Pattern    string
	Severity   string
}

type ThrottleConfig struct {
	// Basic rate limiting
	RequestsPerMinute int
	BurstSize         int
	WindowSize        time.Duration

	// Progressive penalties
	EnableProgressive bool
	MaxPenaltyMinutes int

	// Suspicious behavior detection
	EnableSuspiciousDetection bool
	SuspiciousThreshold       int // Failed requests in window
	SuspiciousPenaltyMinutes  int

	// Subnet-based limiting
	EnableSubnetLimiting    bool
	SubnetRequestsPerMinute int
	SubnetMask              int // /24, /16, etc.

	// Whitelist/Blacklist
	WhitelistedIPs []string
	BlacklistedIPs []string

	// Custom headers to check for real IP
	TrustedProxyHeaders []string
	TrustedProxies      []string
}

type ValidationResult struct {
	Valid        bool
	Errors       []string
	CleanedInput map[string][]string
	Threats      []ThreatDetails
}