// Recommended Supabase auth settings
const authConfig = {
  // Password requirements
  passwordMinLength: 8,
  passwordRequireUppercase: true,
  passwordRequireNumber: true,

  // Session settings
  sessionExpirySeconds: 3600, // 1 hour
  refreshTokenRotation: true,

  // Rate limiting
  maxLoginAttempts: 5,
  lockoutDurationMinutes: 15,
};

import { safeStorage } from 'electron';

class SecureTokenStorage {
  private readonly KEY = 'pairux_auth_token';

  async store(token: string): Promise<void> {
    if (!safeStorage.isEncryptionAvailable()) {
      throw new Error('Secure storage not available');
    }

    const encrypted = safeStorage.encryptString(token);
    // Store encrypted buffer in electron-store or similar
    await this.storage.set(this.KEY, encrypted.toString('base64'));
  }

  async retrieve(): Promise<string | null> {
    const encrypted = await this.storage.get(this.KEY);
    if (!encrypted) return null;

    const buffer = Buffer.from(encrypted, 'base64');
    return safeStorage.decryptString(buffer);
  }

  async clear(): Promise<void> {
    await this.storage.delete(this.KEY);
  }
}

// Use httpOnly cookies set by Supabase
// Never store tokens in localStorage for sensitive apps

class SessionValidator {
  async validateSession(sessionId: string, userId: string): Promise<boolean> {
    // Check session exists and is active
    const { data: session } = await supabase
      .from('sessions')
      .select('*')
      .eq('id', sessionId)
      .eq('status', 'active')
      .single();

    if (!session) return false;

    // Check user is host or authorized participant
    if (session.host_user_id === userId) return true;

    const { data: participant } = await supabase
      .from('session_participants')
      .select('*')
      .eq('session_id', sessionId)
      .eq('user_id', userId)
      .single();

    return !!participant;
  }
}

// WebRTC encryption is automatic, but verify configuration
const pc = new RTCPeerConnection({
  iceServers: [...],
  // These are defaults but explicit for clarity
  bundlePolicy: 'max-bundle',
  rtcpMuxPolicy: 'require',
});

// Verify encryption is active
pc.onconnectionstatechange = () => {
  if (pc.connectionState === 'connected') {
    // Get stats to verify encryption
    pc.getStats().then(stats => {
      stats.forEach(report => {
        if (report.type === 'transport') {
          console.log('DTLS state:', report.dtlsState);
          console.log('SRTP cipher:', report.srtpCipher);
        }
      });
    });
  }
};

// Host generates fingerprint from local description
function getLocalFingerprint(pc: RTCPeerConnection): string | null {
  const sdp = pc.localDescription?.sdp;
  if (!sdp) return null;

  const match = sdp.match(/a=fingerprint:sha-256 ([A-F0-9:]+)/i);
  return match ? match[1] : null;
}

// Display fingerprint for out-of-band verification
// Users can compare fingerprints verbally or via secure channel

import crypto from 'crypto';

function generateTurnCredentials(
  username: string,
  secret: string,
  ttlSeconds: number = 3600
): { username: string; credential: string } {
  const timestamp = Math.floor(Date.now() / 1000) + ttlSeconds;
  const turnUsername = `${timestamp}:${username}`;

  const hmac = crypto.createHmac('sha1', secret);
  hmac.update(turnUsername);
  const credential = hmac.digest('base64');

  return { username: turnUsername, credential };
}

class SecureControlManager {
  private controlState: ControlState = 'view-only';
  private inputInjector: InputInjector;

  constructor(inputInjector: InputInjector) {
    this.inputInjector = inputInjector;
    // Ensure injector starts disabled
    this.inputInjector.disable();
  }

  grantControl(): void {
    this.controlState = 'granted';
    this.inputInjector.enable();
    this.logSecurityEvent('control_granted');
  }

  revokeControl(): void {
    this.controlState = 'view-only';
    this.inputInjector.disable();
    this.logSecurityEvent('control_revoked');
  }

  handleInputEvent(event: InputEvent): void {
    // Double-check state before processing
    if (this.controlState !== 'granted') {
      this.logSecurityEvent('unauthorized_input_attempt', event);
      return;
    }

    // Validate event
    if (!this.validateEvent(event)) {
      this.logSecurityEvent('invalid_input_event', event);
      return;
    }

    // Rate limit
    if (!this.rateLimiter.allow()) {
      this.logSecurityEvent('rate_limit_exceeded');
      return;
    }

    this.inputInjector.handleEvent(event);
  }

  private validateEvent(event: InputEvent): boolean {
    // Coordinate bounds check
    if (event.type === 'mouse') {
      if (event.x < 0 || event.x > 1 || event.y < 0 || event.y > 1) {
        return false;
      }
    }

    // Block dangerous key combinations
    if (event.type === 'keyboard') {
      if (this.isDangerousKeyCombination(event)) {
        return false;
      }
    }

    return true;
  }

  private isDangerousKeyCombination(event: KeyboardEvent): boolean {
    // Block Ctrl+Alt+Delete, Win+L, etc.
    const dangerous = [
      { ctrl: true, alt: true, key: 'Delete' },
      { meta: true, key: 'l' },
      { ctrl: true, alt: true, key: 'F4' },
    ];

    return dangerous.some(
      (combo) =>
        event.modifiers.ctrl === (combo.ctrl || false) &&
        event.modifiers.alt === (combo.alt || false) &&
        event.modifiers.meta === (combo.meta || false) &&
        event.key.toLowerCase() === combo.key.toLowerCase()
    );
  }

  private logSecurityEvent(type: string, data?: any): void {
    console.log(`[SECURITY] ${type}`, data);
    // In production, send to logging service
  }
}

class EmergencyRevokeSystem {
  private readonly HOTKEY = 'CommandOrControl+Shift+Escape';
  private controlManager: SecureControlManager;

  register(): void {
    // Register global hotkey that cannot be overridden
    globalShortcut.register(this.HOTKEY, () => {
      this.emergencyRevoke();
    });

    // Also listen for physical panic button if available
    this.setupHardwarePanicButton();
  }

  private emergencyRevoke(): void {
    // Immediately disable all input
    this.controlManager.revokeControl();

    // Close data channel to prevent further input
    this.dataChannel?.close();

    // Show prominent notification
    this.showEmergencyNotification();

    // Log security event
    this.logSecurityEvent('emergency_revoke');
  }

  private showEmergencyNotification(): void {
    // Show system notification
    new Notification('PairUX', {
      body: 'Remote control has been revoked',
      urgency: 'critical',
    });

    // Also show in-app notification
    this.emit('emergency-revoke');
  }
}

import { systemPreferences } from 'electron';

class MacOSPermissions {
  async checkAllPermissions(): Promise<PermissionStatus> {
    return {
      screenRecording: await this.checkScreenRecording(),
      accessibility: this.checkAccessibility(),
    };
  }

  private async checkScreenRecording(): Promise<boolean> {
    const status = systemPreferences.getMediaAccessStatus('screen');
    return status === 'granted';
  }

  private checkAccessibility(): boolean {
    return systemPreferences.isTrustedAccessibilityClient(false);
  }

  async requestPermissions(): Promise<void> {
    // Screen recording - must be granted in System Preferences
    if (!(await this.checkScreenRecording())) {
      // Open System Preferences
      shell.openExternal(
        'x-apple.systempreferences:com.apple.preference.security?Privacy_ScreenCapture'
      );
    }

    // Accessibility - can prompt
    if (!this.checkAccessibility()) {
      systemPreferences.isTrustedAccessibilityClient(true);
    }
  }
}

interface PermissionStatus {
  screenRecording: boolean;
  accessibility: boolean;
}

class WindowsSecurity {
  // Check if running as admin (may be needed for some apps)
  isAdmin(): boolean {
    try {
      execSync('net session', { stdio: 'ignore' });
      return true;
    } catch {
      return false;
    }
  }

  // Windows Defender may flag the app
  async checkDefenderExclusion(): Promise<boolean> {
    // Check if app is excluded from Windows Defender
    // This requires admin privileges
    return false; // Implement based on needs
  }
}

class LinuxSecurity {
  getDisplayServer(): 'x11' | 'wayland' | 'unknown' {
    if (process.env.XDG_SESSION_TYPE === 'wayland') return 'wayland';
    if (process.env.XDG_SESSION_TYPE === 'x11') return 'x11';
    if (process.env.WAYLAND_DISPLAY) return 'wayland';
    if (process.env.DISPLAY) return 'x11';
    return 'unknown';
  }

  checkWaylandSupport(): boolean {
    // Wayland has stricter security - may limit functionality
    const displayServer = this.getDisplayServer();
    if (displayServer === 'wayland') {
      console.warn('Wayland detected - some features may be limited');
      return false;
    }
    return true;
  }
}

class SecureLogger {
  // Never log sensitive data
  private readonly REDACTED_FIELDS = [
    'password',
    'token',
    'credential',
    'sdp', // Contains ICE credentials
  ];

  log(level: string, message: string, data?: any): void {
    const sanitized = this.sanitize(data);
    console.log(`[${level}] ${message}`, sanitized);
  }

  private sanitize(data: any): any {
    if (!data) return data;
    if (typeof data !== 'object') return data;

    const result = { ...data };
    for (const field of this.REDACTED_FIELDS) {
      if (field in result) {
        result[field] = '[REDACTED]';
      }
    }
    return result;
  }
}

// Always show clear visual indicator when control is active
class SecurityIndicator {
  private indicator: BrowserWindow | null = null;

  showControlActive(): void {
    // Create always-on-top indicator
    this.indicator = new BrowserWindow({
      width: 200,
      height: 40,
      x: 10,
      y: 10,
      frame: false,
      alwaysOnTop: true,
      skipTaskbar: true,
      transparent: true,
      focusable: false,
    });

    this.indicator.loadURL(`data:text/html,
      <div style="
        background: #EF4444;
        color: white;
        padding: 8px 16px;
        border-radius: 8px;
        font-family: system-ui;
        font-weight: bold;
      ">
        🔴 Remote Control Active
      </div>
    `);
  }

  hideControlActive(): void {
    this.indicator?.close();
    this.indicator = null;
  }
}

class IncidentHandler {
  async handleSecurityIncident(incident: SecurityIncident): Promise<void> {
    // Log incident
    await this.logIncident(incident);

    // Take immediate action based on severity
    switch (incident.severity) {
      case 'critical':
        await this.terminateSession(incident.sessionId);
        await this.notifyHost(incident);
        break;
      case 'high':
        await this.revokeControl(incident.sessionId);
        await this.notifyHost(incident);
        break;
      case 'medium':
        await this.notifyHost(incident);
        break;
      case 'low':
        // Log only
        break;
    }
  }
}