// Frontend (Next.js)
const MAX_FILE_SIZE = 10 * 1024 * 1024; // 10MB

function validateFileSize(file: File): boolean {
  if (file.size > MAX_FILE_SIZE) {
    throw new Error(`File too large. Max size: ${MAX_FILE_SIZE / 1024 / 1024}MB`);
  }
  return true;
}

function sanitizeFileName(fileName: string): string {
  return fileName
    .replace(/[^a-zA-Z0-9._-]/g, '_')  // Remove special chars
    .replace(/\.{2,}/g, '.')            // No multiple dots
    .replace(/^\./, '')                 // No leading dot
    .substring(0, 255);                 // Max 255 chars
}

// Generate secure file names
const secureFileName = `${uuid()}_${sanitizeFileName(file.name)}`;

// ❌ DANGEROUS
const path = `uploads/${userInput}`;

// ✅ SAFE
const path = `uploads/${userId}/${uuid()}_${sanitizedName}`;

const ALLOWED_TYPES = {
  images: ['image/jpeg', 'image/png', 'image/gif', 'image/webp'],
  documents: ['application/pdf', 'application/msword'],
  videos: ['video/mp4', 'video/webm'],
};

function validateFileType(file: File, category: keyof typeof ALLOWED_TYPES): boolean {
  const allowed = ALLOWED_TYPES[category];

  if (!allowed.includes(file.type)) {
    throw new Error(`Invalid file type. Allowed: ${allowed.join(', ')}`);
  }

  return true;
}

async function validateImageSignature(file: File): Promise<boolean> {
  const buffer = await file.slice(0, 4).arrayBuffer();
  const bytes = new Uint8Array(buffer);

  // JPEG: FF D8 FF
  if (bytes[0] === 0xFF && bytes[1] === 0xD8 && bytes[2] === 0xFF) {
    return true;
  }

  // PNG: 89 50 4E 47
  if (bytes[0] === 0x89 && bytes[1] === 0x50 && bytes[2] === 0x4E && bytes[3] === 0x47) {
    return true;
  }

  throw new Error('Invalid image signature');
}

const DANGEROUS_EXTENSIONS = [
  '.exe', '.dll', '.bat', '.cmd', '.sh',
  '.php', '.asp', '.jsp', '.js', '.html',
  '.svg',  // Can contain scripts
  '.jar', '.app', '.dmg',
];

function checkDangerousExtension(fileName: string): boolean {
  const ext = fileName.toLowerCase().substring(fileName.lastIndexOf('.'));

  if (DANGEROUS_EXTENSIONS.includes(ext)) {
    throw new Error(`Dangerous file type: ${ext}`);
  }

  return true;
}

import { signUrl } from '@/lib/storage';

// Generate time-limited URL
const signedUrl = await signUrl(file.path, {
  expiresIn: 3600,  // 1 hour
  userId: currentUser.id,
});

// URL expires after 1 hour
return { url: signedUrl };

// Use Redis for rate limiting
import { rateLimit } from '@/lib/redis';

async function uploadHandler(req, res) {
  const userId = req.user.id;

  // Limit: 10 uploads per hour per user
  const allowed = await rateLimit(`upload:${userId}`, {
    max: 10,
    window: 3600,
  });

  if (!allowed) {
    return res.status(429).json({
      error: 'Too many uploads. Try again later.',
    });
  }

  // Process upload...
}

// Frontend: Remove EXIF before upload
import piexif from 'piexifjs';

function stripExif(file: File): Promise<File> {
  return new Promise((resolve) => {
    const reader = new FileReader();
    reader.onload = (e) => {
      const data = e.target?.result as string;
      const stripped = piexif.remove(data);
      const blob = dataURLtoBlob(stripped);
      resolve(new File([blob], file.name, { type: file.type }));
    };
    reader.readAsDataURL(file);
  });
}

// If you MUST allow SVGs, sanitize them
import { sanitize } from 'dompurify';

function sanitizeSVG(svgContent: string): string {
  return sanitize(svgContent, {
    USE_PROFILES: { svg: true },
    ALLOWED_TAGS: ['svg', 'path', 'circle', 'rect', 'line', 'polyline', 'polygon'],
    ALLOWED_ATTR: ['width', 'height', 'viewBox', 'd', 'fill', 'stroke'],
  });
}

// Complete secure upload implementation
async function secureFileUpload(file: File, userId: string) {
  // 1. Client-side validation
  validateFileSize(file);
  validateFileType(file, 'images');
  await validateImageSignature(file);
  checkDangerousExtension(file.name);

  // 2. Sanitize file name
  const safeName = sanitizeFileName(file.name);

  // 3. Strip EXIF data
  const strippedFile = await stripExif(file);

  // 4. Check rate limit
  const allowed = await rateLimit(`upload:${userId}`, {
    max: 10,
    window: 3600,
  });

  if (!allowed) {
    throw new Error('Rate limit exceeded');
  }

  // 5. Check storage quota
  const quota = await checkStorageQuota(userId, file.size);
  if (!quota.allowed) {
    throw new Error('Storage quota exceeded');
  }

  // 6. Upload with virus scan
  const result = await uploadFile(strippedFile, {
    path: `users/${userId}/${uuid()}_${safeName}`,
    virusScan: true,
    compression: true,
  });

  // 7. Save metadata with RLS
  const fileRecord = await db.files.insert({
    user_id: userId,
    name: safeName,
    size: file.size,
    mime_type: result.mimeType,
    path: result.path,
    url: result.url,
    is_public: false,
  });

  // 8. Audit log
  await logAuditEvent({
    action: 'file_uploaded',
    user_id: userId,
    file_id: fileRecord.id,
    file_size: file.size,
    ip: request.ip,
  });

  return fileRecord;
}