// User roles
export enum UserRole {
  CUSTOMER = 'customer',
  ADMIN = 'admin',
  SUPPORT = 'support',
  CONSULTANT = 'consultant',
}

// Permission mapping
export const permissions = {
  [UserRole.CUSTOMER]: {
    products: ['read'],
    orders: ['read', 'create'],
    account: ['read', 'update'],
    consultations: ['read', 'book'],
  },
  [UserRole.ADMIN]: {
    products: ['read', 'create', 'update', 'delete'],
    orders: ['read', 'update', 'cancel'],
    users: ['read', 'create', 'update', 'delete'],
    consultations: ['read', 'update', 'delete'],
    analytics: ['read'],
  },
  [UserRole.SUPPORT]: {
    orders: ['read', 'update'],
    users: ['read'],
    consultations: ['read', 'update'],
  },
  [UserRole.CONSULTANT]: {
    consultations: ['read', 'update'],
    customers: ['read'],
    products: ['read'],
  },
}

// Authorization hook
export function useAuthorization() {
  const { user } = useAuth()
  
  const hasPermission = (resource, action) => {
    if (!user) return false
    
    const role = user.app_metadata?.role || UserRole.CUSTOMER
    return permissions[role]?.[resource]?.includes(action) || false
  }
  
  return {
    hasPermission,
    isAdmin: user?.app_metadata?.role === UserRole.ADMIN,
    isSupport: user?.app_metadata?.role === UserRole.SUPPORT,
    isConsultant: user?.app_metadata?.role === UserRole.CONSULTANT,
  }
}

-- Example RLS policies for the orders table

-- Enable RLS on the orders table
ALTER TABLE public.orders ENABLE ROW LEVEL SECURITY;

-- Customers can only view their own orders
CREATE POLICY "Customers can view their own orders"
ON public.orders
FOR SELECT
USING (auth.uid() = user_id);

-- Customers can only create orders for themselves
CREATE POLICY "Customers can create orders for themselves"
ON public.orders
FOR INSERT
WITH CHECK (auth.uid() = user_id);

-- Admins can view all orders
CREATE POLICY "Admins can view all orders"
ON public.orders
FOR SELECT
USING (
  EXISTS (
    SELECT 1 FROM public.users
    WHERE users.id = auth.uid()
    AND users.role = 'admin'
  )
);

-- Support can view all orders
CREATE POLICY "Support can view all orders"
ON public.orders
FOR SELECT
USING (
  EXISTS (
    SELECT 1 FROM public.users
    WHERE users.id = auth.uid()
    AND users.role = 'support'
  )
);

-- Admins can update all orders
CREATE POLICY "Admins can update all orders"
ON public.orders
FOR UPDATE
USING (
  EXISTS (
    SELECT 1 FROM public.users
    WHERE users.id = auth.uid()
    AND users.role = 'admin'
  )
);

-- Support can update all orders
CREATE POLICY "Support can update all orders"
ON public.orders
FOR UPDATE
USING (
  EXISTS (
    SELECT 1 FROM public.users
    WHERE users.id = auth.uid()
    AND users.role = 'support'
  )
);

// Example input validation with Zod
import { z } from 'zod'

// User input schema
const userProfileSchema = z.object({
  name: z.string().min(2).max(100),
  email: z.string().email(),
  phone: z.string().regex(/^\+?[0-9]{10,15}$/).optional(),
  birthDate: z.string().regex(/^\d{4}-\d{2}-\d{2}$/).optional(),
  preferences: z.object({
    newsletter: z.boolean(),
    marketingEmails: z.boolean(),
    textNotifications: z.boolean(),
  }),
})

// Validate user input
export async function updateUserProfile(req, res) {
  try {
    // Validate request body against schema
    const validatedData = userProfileSchema.parse(req.body)
    
    // Proceed with update if validation passes
    const { data, error } = await supabase
      .from('profiles')
      .update(validatedData)
      .eq('id', req.user.id)
    
    if (error) throw error
    
    return res.status(200).json({ success: true, data })
  } catch (error) {
    if (error instanceof z.ZodError) {
      // Return validation errors
      return res.status(400).json({ 
        success: false, 
        error: 'Validation error', 
        details: error.errors 
      })
    }
    
    // Handle other errors
    return res.status(500).json({ 
      success: false, 
      error: 'Server error' 
    })
  }
}

// Example CSRF protection middleware
import { csrf } from 'next-csrf'

// CSRF configuration
const csrfConfig = {
  cookieName: 'csrf-token',
  cookieOptions: {
    httpOnly: true,
    sameSite: 'strict',
    path: '/',
    secure: process.env.NODE_ENV === 'production',
  },
  secretKey: process.env.CSRF_SECRET,
}

// Create CSRF middleware
const { csrfToken, setupCSRF } = csrf(csrfConfig)

// Apply middleware to API routes
export default async function apiHandler(req, res) {
  // Initialize CSRF protection
  await setupCSRF(req, res)
  
  // Handle different HTTP methods
  switch (req.method) {
    case 'GET':
      // For GET requests, include the CSRF token in the response
      return res.status(200).json({
        csrfToken: await csrfToken(req, res),
        // Other response data
      })
    case 'POST':
    case 'PUT':
    case 'DELETE':
      // For mutation operations, CSRF token is verified automatically by the middleware
      // Continue with the handler logic
      return handleMutation(req, res)
    default:
      return res.status(405).json({ error: 'Method not allowed' })
  }
}

// Content Security Policy configuration
const cspConfig = {
  'default-src': ["'self'"],
  'script-src': ["'self'", "'unsafe-inline'", 'https://analytics.moodmnky.co'],
  'style-src': ["'self'", "'unsafe-inline'", 'https://fonts.googleapis.com'],
  'img-src': ["'self'", 'data:', 'https://storage.moodmnky.co', 'https://res.cloudinary.com'],
  'font-src': ["'self'", 'https://fonts.gstatic.com'],
  'connect-src': [
    "'self'",
    'https://*.supabase.co',
    'https://analytics.moodmnky.co',
    'https://api.moodmnky.co',
  ],
  'frame-src': ["'self'", 'https://js.stripe.com'],
  'object-src': ["'none'"],
  'base-uri': ["'self'"],
  'form-action': ["'self'"],
  'frame-ancestors': ["'self'"],
  'upgrade-insecure-requests': [],
}

// Convert config to CSP header string
const cspString = Object.entries(cspConfig)
  .map(([key, values]) => {
    if (values.length === 0) return key
    return `${key} ${values.join(' ')}`
  })
  .join('; ')

// Add to Next.js config
module.exports = {
  async headers() {
    return [
      {
        // Apply to all routes
        source: '/(.*)',
        headers: [
          {
            key: 'Content-Security-Policy',
            value: cspString,
          },
          {
            key: 'X-Content-Type-Options',
            value: 'nosniff',
          },
          {
            key: 'X-Frame-Options',
            value: 'DENY',
          },
          {
            key: 'X-XSS-Protection',
            value: '1; mode=block',
          },
          {
            key: 'Referrer-Policy',
            value: 'strict-origin-when-cross-origin',
          },
          {
            key: 'Permissions-Policy',
            value: 'camera=(), microphone=(), geolocation=()',
          },
        ],
      },
    ]
  },
}