import { createCsrf } from '@goobits/security/csrf'
import { buildCsp } from '@goobits/security/csp'
import { createRateLimiter } from '@goobits/security/rate-limit'
import { verifyRecaptcha } from '@goobits/security/recaptcha'
import { getInputValidator } from '@goobits/security/validation'
import { withValidation } from '@goobits/security/validation/sveltekit'
import { createAdminAuth } from '@goobits/security/admin-auth'
import { createAuditLogger } from '@goobits/security/audit'
import { withAudit } from '@goobits/security/audit/sveltekit'
import { createSecurityAlerter, createWebhookChannel } from '@goobits/security/alerting'

import { createCsrf } from '@goobits/security/csrf'

const csrf = createCsrf()

// In a page load or hook:
const response = await resolve(event)
const token = await csrf.generate()
csrf.setCookie(response, token)
return response

// In a form action:
if (!(await csrf.validate(event.request))) {
  return new Response('Invalid CSRF token', { status: 403 })
}

import Redis from 'ioredis'
import { createCsrf } from '@goobits/security/csrf'
import { createRedisCsrfStore } from '@goobits/security/csrf-redis'

const client = new Redis(process.env.REDIS_URL!)
const csrf = createCsrf({
  tokenStore: createRedisCsrfStore({ client })
})

const csrf = createCsrf({ failClosed: true })

// On a route that explicitly checks expiration:
if (!(await csrf.validate(event.request, { checkExpiry: true }))) {
  return new Response('CSRF validation failed', { status: 403 })
}

import { buildCsp } from '@goobits/security/csp'

const isProd = process.env.NODE_ENV === 'production'
// In SvelteKit/Vite, use `import.meta.env.PROD` instead.

response.headers.set('Content-Security-Policy', buildCsp({
  mode: isProd ? 'production' : 'development',
  nonce: locals.cspNonce,
  extraSources: {
    'script-src': ['https://js.stripe.com'],
    'connect-src': ['https://api.stripe.com'],
    'img-src':    ['https://cdn.example.com', 'data:']
  }
}))

import { createRateLimiter } from '@goobits/security/rate-limit'
import { createRateLimitHandle } from '@goobits/security/rate-limit/sveltekit'

const limiter = createRateLimiter({
  windows: [
    { name: 'burst', windowMs:    60_000, maxEvents:  5 },
    { name: 'hour',  windowMs: 3_600_000, maxEvents: 60 }
  ]
})

// As a SvelteKit Handle:
export const handle = createRateLimitHandle({
  limiter,
  identifier: (event) => event.getClientAddress()
})

// Or imperatively:
const verdict = await limiter.check(clientId)
if (!verdict.allowed) {
  return new Response('Too Many Requests', {
    status: 429,
    headers: { 'Retry-After': String(verdict.retryAfterSec) }
  })
}

import { getClientIP } from '@goobits/security/rate-limit'

// Cloudflare:
const ip = getClientIP(event.request, { trustHeaders: ['cf-connecting-ip'] })

// AWS ALB / GCP LB (configured to strip client-supplied XFF):
const ip = getClientIP(event.request, { trustHeaders: ['x-forwarded-for'] })

import {
  createLoginRateLimiter,
  createRegistrationRateLimiter,
  createPasswordResetRateLimiter
} from '@goobits/security/rate-limit/auth'

const loginLimiter        = createLoginRateLimiter()         // 5/min, 15/15min
const registrationLimiter = createRegistrationRateLimiter()  // 3/10min, 5/hour
const passwordResetLimiter = createPasswordResetRateLimiter() // 3/15min, 5/hour

import { MemoryRateLimitStore, createRateLimiter } from '@goobits/security/rate-limit'

const store = new MemoryRateLimitStore({ cleanupProbability: 0.05 }) // 5% per increment
const limiter = createRateLimiter({ windows: [...], store })

import { verifyRecaptcha } from '@goobits/security/recaptcha'

const result = await verifyRecaptcha(token, {
  action: 'submit_contact_form',
  minScore: 0.7
})

if (!result.success) {
  console.error('reCAPTCHA failed:', result.reason)
  return new Response('Captcha failed', { status: 400 })
}
console.log('Score:', result.score)

const result = await verifyRecaptcha(token, { allowInDevelopment: true })

const result = await verifyRecaptcha(token, { timeoutMs: 2000 })
// timeout returns: { success: false, reason: 'api-error' }

import { z } from 'zod'
import { withValidation } from '@goobits/security/validation/sveltekit'

export const POST = withValidation(
  {
    body: z.object({ email: z.email(), name: z.string().min(1) }),  // Zod v4 syntax
    query: z.object({ source: z.string().optional() })
  },
  async (event) => {
    const { body, query } = event.locals.validatedData
    // ...
    return new Response('OK')
  }
)

import { getInputValidator } from '@goobits/security/validation'

const validate = getInputValidator(z.object({ email: z.email() }))
const result = validate({ email: '[email protected]' })
if (result.success) {
  console.log(result.data.email)
} else {
  console.error(result.issues)
}

import { createAdminAuth, generateAdminApiKey } from '@goobits/security/admin-auth'

const adminAuth = createAdminAuth({
  jwtSecret: process.env.JWT_SECRET!,   // >= 32 chars — throws otherwise
  apiKey:    process.env.ADMIN_API_KEY, // optional fallback
  algorithms: ['HS256'],                // default: ['HS256'] (pinned tight)
  audience:  'my-app',                  // optional — rejected if token aud differs
  issuer:    'my-auth-service',         // optional — rejected if token iss differs
  clockTolerance: 30                    // optional — seconds of skew tolerated on exp/nbf
})

export async function POST({ request }) {
  const result = await adminAuth.requireAdmin(request)
  if (!result.authenticated) {
    return new Response('Unauthorized', { status: 401 })
  }
  // result.user.id, result.method ('jwt' | 'apikey')
}

// Issue a new token (NOTE: async since the v2.0.0 jose swap):
const token = await adminAuth.createAdminToken({ id: 'user-1', role: 'admin' })

// Numeric tokenTtl is RELATIVE seconds (1 hour below), NOT absolute UNIX time:
const shortToken = await adminAuth.createAdminToken({ id: 'u1', role: 'admin' }, 3600)

// Generate a fresh API key (256-bit, hex-encoded) — store this once at
// provisioning time in your secret manager; do not regenerate per request:
const key = generateAdminApiKey()

import { createAuditLogger } from '@goobits/security/audit'
import { withAudit } from '@goobits/security/audit/sveltekit'

const auditor = createAuditLogger({
  sink: {
    async record(event) {
      await db.insert('audit_log').values(event)
    }
  }
})

// Wrap a handler:
export const POST = withAudit(
  { action: 'admin.delete-user', auditor, actorId: (e) => e.locals.user?.id },
  async (event) => {
    // ... your logic ...
    return new Response('OK')
  }
)

// Capture the request body (e.g. for a contact form audit) with redaction:
export const POST = withAudit(
  {
    action: 'contact.submit',
    auditor,
    includeRequestBody: true,
    // Defaults: ['password', 'token', 'secret', 'apiKey', 'authorization',
    // 'creditCard', 'cvv']. Override with your own set (case-insensitive,
    // recurses into nested objects and arrays). Pass `redactKeys: []` to
    // disable redaction entirely (NOT recommended for routes with credentials).
    redactKeys: ['password', 'token', 'creditCard', 'ssn']
  },
  async (event) => { /* ... */ return new Response('OK') }
)

// Or call directly:
await auditor.log({
  action: 'user.login',
  outcome: 'success',
  actorId: user.id
})

import { createSecurityAlerter, createWebhookChannel } from '@goobits/security/alerting'

const slack = createWebhookChannel({
  url: process.env.SLACK_WEBHOOK_URL!,
  transform: (a) => ({
    text: `*[${ a.severity.toUpperCase() }]* ${ a.title }\n${ a.message }`
  })
})

const alerter = createSecurityAlerter({
  channels: [ slack ],
  rules: [
    // Alert on any admin-route denial:
    (event) => event.action.startsWith('admin.') && event.outcome === 'denied'
      ? {
          severity: 'critical',
          title: 'Admin access denied',
          message: event.action,
          source: 'goobits/security',
          timestamp: event.timestamp,
          context: { actorId: event.actorId, clientIp: event.clientIp }
        }
      : null
  ]
})

// Plug into the audit sink:
const auditor = createAuditLogger({
  sink: {
    async record(event) {
      await db.insert('audit_log').values(event)
      await alerter.process(event)
    }
  }
})

import { createConsoleLogger } from '@goobits/security/logger'

const log = createConsoleLogger({ prefix: '[my-app]', level: 'debug' })

const csrf = createCsrf({ logger: log })