// ❌ Development-only setup — not production ready
const app = express();
app.use(cors());                    // Wide open CORS
app.use(morgan('dev'));              // Verbose logging
app.listen(3000);                    // No graceful shutdown

// In production, you need:
// ✅ Rate limiting, helmet, CORS restriction
// ✅ Graceful shutdown (SIGTERM handler)
// ✅ Health checks for orchestrator
// ✅ Process manager (PM2 or Docker)
// ✅ Structured logging
// ✅ Request size limits

Production Architecture:

User → CDN → WAF → Load Balancer → Nginx → Node.js → Database
         │       │        │           │        │          │
         │   Rate limit  │       SSL term.   Cluster     Pool
         │   WAF rules   │       Static      Workers    Connection
         │   DDoS protect│       files       PM2        Replicas
         │               │                              │
         │               │                              │
         ▼               ▼                              ▼
    Cloudflare       AWS ALB                         Redis/MongoDB

flowchart TD
    subgraph Edge["🌐 Edge Layer"]
        CDN["CDN (Cloudflare)<br/>DDoS protection, caching"]
        WAF["WAF<br/>Request filtering"]
    end

    subgraph LB["📡 Load Balancing"]
        ALB["Load Balancer<br/>SSL termination<br/>Health checks"]
    end

    subgraph App["⚡ Application Layer"]
        Nginx["Nginx Reverse Proxy<br/>Static files, rate limit"]
        Node["Node.js (Clustered)<br/>PM2, multiple workers"]
    end

    subgraph Data["🗄️ Data Layer"]
        Cache["Redis Cache<br/>Sessions, rate limiting"]
        DB["Database<br/>PostgreSQL/MongoDB"]
    end

    subgraph Monitor["🔍 Monitoring"]
        Prometheus["Prometheus"]
        Grafana["Grafana"]
        Sentry["Sentry"]
    end

    User["👤 User"] --> CDN
    CDN --> WAF
    WAF --> ALB
    ALB --> Nginx
    Nginx --> Node
    Node --> Cache
    Node --> DB
    Node -.-> Prometheus
    Prometheus -.-> Grafana
    Node -.-> Sentry

flowchart TD
    Request["Incoming Request"] --> L1

    subgraph L1["Layer 1: Network"]
        L1A["Firewall (IP whitelist)"]
        L1B["DDoS Protection"]
        L1C["Rate Limiting"]
    end

    subgraph L2["Layer 2: Transport"]
        L2A["TLS/SSL (HTTPS)"]
        L2B["HSTS header"]
    end

    subgraph L3["Layer 3: Application"]
        L3A["Helmet (security headers)"]
        L3B["CORS validation"]
        L3C["Input sanitization"]
    end

    subgraph L4["Layer 4: Auth"]
        L4A["JWT verification"]
        L4B["Session validation"]
        L4C["Role-based access"]
    end

    subgraph L5["Layer 5: Data"]
        L5A["Parameterized queries"]
        L5B["Output encoding"]
        L5C["Encryption at rest"]
    end

    L1 --> L2
    L2 --> L3
    L3 --> L4
    L4 --> L5
    L5 --> Response["✅ Safe Response"]

    style L1 fill:#4f46e5,color:#fff
    style L2 fill:#7c3aed,color:#fff
    style L3 fill:#059669,color:#fff
    style L4 fill:#d97706,color:#fff
    style L5 fill:#dc2626,color:#fff

const helmet = require('helmet');
const rateLimit = require('express-rate-limit');
const cors = require('cors');

// Security headers
app.use(helmet());

// CORS — restrict origin
app.use(cors({ origin: process.env.CLIENT_URL }));

// Rate limiting
const limiter = rateLimit({
  windowMs: 15 * 60 * 1000,  // 15 minutes
  max: 100,                    // 100 requests per window
  message: { error: 'Too many requests' },
});
app.use('/api', limiter);

process.on('SIGTERM', async () => {
  console.log('SIGTERM received. Starting graceful shutdown...');
  server.close(async () => {
    await mongoose.disconnect();
    await redis.quit();
    process.exit(0);
  });
});

const express = require('express');
const helmet = require('helmet');
const rateLimit = require('express-rate-limit');
const cors = require('cors');
const { body, validationResult } = require('express-validator');

const app = express();

// 1. Security headers
app.use(helmet());

// 2. CORS — only allow your frontend
app.use(cors({
  origin: process.env.CLIENT_URL || 'http://localhost:3000',
  credentials: true,
}));

// 3. Request size limit
app.use(express.json({ limit: '10kb' }));

// 4. Rate limiting
const limiter = rateLimit({
  windowMs: 15 * 60 * 1000,
  max: 100,
  standardHeaders: true,
  legacyHeaders: false,
});
app.use('/api', limiter);

// 5. Strict rate limit for auth endpoints
const authLimiter = rateLimit({
  windowMs: 15 * 60 * 1000,
  max: 5,
  message: { error: 'Too many login attempts. Try again later.' },
});
app.use('/api/auth/login', authLimiter);

// 6. Input validation
app.post('/api/users', [
  body('email').isEmail().normalizeEmail(),
  body('password').isLength({ min: 8 }),
], (req, res) => {
  const errors = validationResult(req);
  if (!errors.isEmpty()) {
    return res.status(422).json({ errors: errors.array() });
  }
  // Process request...
});

app.listen(3000);

const express = require('express');
const http = require('http');

const app = express();
const server = http.createServer(app);

// Graceful shutdown handler
async function shutdown(signal) {
  console.log(`\n${signal} received. Starting graceful shutdown...`);

  // 1. Stop accepting new connections
  server.close(() => {
    console.log('HTTP server closed');
  });

  // 2. Give existing requests time to complete (max 30 seconds)
  const forceExit = setTimeout(() => {
    console.error('Forced shutdown after timeout');
    process.exit(1);
  }, 30000);

  try {
    // 3. Close database connections
    await mongoose.disconnect();
    console.log('MongoDB disconnected');

    // 4. Close Redis connection
    await redis.quit();
    console.log('Redis disconnected');

    // 5. Close queue connections
    await emailQueue.close();
    console.log('Queues closed');

    clearTimeout(forceExit);
    console.log('Graceful shutdown complete');
    process.exit(0);
  } catch (err) {
    console.error('Error during shutdown:', err);
    process.exit(1);
  }
}

// Listen for shutdown signals
process.on('SIGTERM', () => shutdown('SIGTERM'));
process.on('SIGINT', () => shutdown('SIGINT'));

// Health check for orchestrator
app.get('/health', (req, res) => {
  res.json({ status: 'healthy' });
});

// Readiness check — are we accepting connections?
app.get('/ready', async (req, res) => {
  try {
    await mongoose.connection.db.admin().ping();
    await redis.ping();
    res.json({ status: 'ready' });
  } catch (err) {
    res.status(503).json({ status: 'not ready', error: err.message });
  }
});

server.listen(3000, () => {
  console.log('Server started. Ready for connections.');
  // Signal to PM2 that the app is ready
  if (process.send) process.send('ready');
});

# Dockerfile with security hardening

# Stage 1: Build
FROM node:20-alpine AS builder
WORKDIR /app

# Copy only package files first (layer caching)
COPY package*.json ./
RUN npm ci

# Copy source and build
COPY . .
RUN npm run build

# Stage 2: Run (minimal)
FROM node:20-alpine AS production
WORKDIR /app

# Security: Create non-root user
RUN addgroup -g 1001 -S appgroup && \
    adduser -S appuser -u 1001 -G appgroup

# Security: Only copy production files
COPY --from=builder --chown=appuser:appgroup /app/dist ./dist
COPY --from=builder --chown=appuser:appgroup /app/node_modules ./node_modules
COPY --from=builder --chown=appuser:appgroup /app/package.json ./

# Security: Switch to non-root user
USER appuser

# Security: Mark port for documentation
EXPOSE 3000

# Security: Health check
HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
  CMD wget --no-verbose --tries=1 --spider http://localhost:3000/health || exit 1

# Use tini to handle signals properly
RUN apk add --no-cache tini
ENTRYPOINT ["/sbin/tini", "--"]
CMD ["node", "dist/server.js"]

# docker-compose.yml with security settings
version: '3.8'

services:
  app:
    build:
      context: .
      target: production
    ports:
      - "3000:3000"
    environment:
      - NODE_ENV=production
      - DB_URL=mongodb://mongo:27017/myapp
    depends_on:
      mongo:
        condition: service_healthy
    restart: unless-stopped
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    cap_add:
      - NET_BIND_SERVICE
    read_only: true
    tmpfs:
      - /tmp
    healthcheck:
      test: ["CMD", "node", "-e", "require('http').get('http://localhost:3000/health')"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 15s

  mongo:
    image: mongo:7
    environment:
      - MONGO_INITDB_ROOT_USERNAME=admin
      - MONGO_INITDB_ROOT_PASSWORD=${MONGO_PASSWORD}
    volumes:
      - mongo-data:/data/db
    healthcheck:
      test: echo 'db.runCommand("ping").ok' | mongosh --quiet
      interval: 30s

volumes:
  mongo-data:

// security-audit.js — Run this checklist before production deployment

const securityChecks = {
  'Dependencies': async () => {
    const { exec } = require('child_process');
    // Check for known vulnerabilities
    return new Promise((resolve) => {
      exec('npm audit --audit-level=high', (err, stdout) => {
        resolve(stdout.includes('found 0 vulnerabilities') ? '✅ PASS' : '❌ FAIL');
      });
    });
  },

  'Security Headers': () => {
    const checks = [
      'content-security-policy',
      'x-frame-options',
      'x-content-type-options',
      'strict-transport-security',
    ];
    // Run against deployed endpoint
    return `Check ${checks.length} headers configured`;
  },

  'Rate Limiting': () => {
    const checks = ['/api', '/api/auth/login'];
    return `Rate limit enabled on ${checks.join(', ')}`;
  },

  'Input Validation': () => {
    const checks = ['All POST/PUT endpoints', 'SQL injection prevention', 'XSS sanitization'];
    return `${checks.length} validation checks`;
  },

  'Authentication': () => {
    const checks = ['JWT expiration', 'Password hashing (bcrypt)', 'Failed login lockout'];
    return `${checks.length} auth checks`;
  },

  'Infrastructure': () => {
    const checks = [
      'Graceful shutdown configured',
      'Health check endpoint',
      'Non-root user in Docker',
      'Read-only filesystem in container',
      'Secrets from environment variables',
    ];
    return `${checks.length} infra checks`;
  },

  'Monitoring': () => {
    const checks = ['Structured logging', 'Error tracking (Sentry)', 'Metrics endpoint', 'Alerting configured'];
    return `${checks.length} monitoring checks`;
  },
};

// Production readiness score
async function runSecurityAudit() {
  console.log('🔒 Running Production Security Audit...\n');
  let passed = 0;
  const total = Object.keys(securityChecks).length;

  for (const [category, check] of Object.entries(securityChecks)) {
    const result = await check();
    if (result.startsWith('✅')) passed++;
    console.log(`${result} - ${category}`);
  }

  console.log(`\n📊 Score: ${passed}/${total} (${Math.round(passed/total*100)}%)`);
  if (passed < total) {
    console.log('⚠️  Fix failing checks before deploying to production.');
  }
}

runSecurityAudit();

// app.js — Final production template

const express = require('express');
const helmet = require('helmet');
const cors = require('cors');
const rateLimit = require('express-rate-limit');
const compression = require('compression');

const app = express();

// 1. Security
app.use(helmet());
app.use(cors({ origin: process.env.CLIENT_URL }));
app.use(express.json({ limit: '10kb' }));

// 2. Performance
app.use(compression());

// 3. Rate limiting
app.use('/api', rateLimit({ windowMs: 15 * 60 * 1000, max: 100 }));

// 4. Routes
app.use('/api/users', require('./routes/users'));
app.use('/api/auth', require('./routes/auth'));

// 5. Error handler (last!)
app.use((err, req, res, next) => {
  logger.error({ err }, 'Unhandled error');
  res.status(err.status || 500).json({
    error: process.env.NODE_ENV === 'production'
      ? 'Internal server error'
      : err.message,
  });
});

const express = require('express');
const app = express();

// Bug 1: No Helmet — missing security headers!
// Bug 2: CORS allows any origin!
app.use(cors());

// Bug 3: No rate limiting — anyone can brute force!
app.post('/api/auth/login', async (req, res) => {
  // Bug 4: No request size limit
  // Bug 5: No input validation
  const user = await User.findOne({ email: req.body.email });

  // Bug 6: The error message reveals too much!
  if (!user) return res.status(401).json({ error: 'Email not found' });

  // Bug 7: No bcrypt — plain text password comparison!
  if (req.body.password !== user.password) {
    return res.status(401).json({ error: 'Wrong password' });
  }
});

// Quick reference: Production Architecture & Security

// 1. Security
const helmet = require('helmet');
app.use(helmet());
app.use(cors({ origin: process.env.CLIENT_URL }));
app.use(express.json({ limit: '10kb' }));

// 2. Rate limiting
const rateLimit = require('express-rate-limit');
app.use('/api', rateLimit({ windowMs: 15*60*1000, max: 100 }));

// 3. Graceful shutdown
process.on('SIGTERM', async () => {
  server.close(() => process.exit(0));
  await mongoose.disconnect();
});

// 4. Health checks
app.get('/health', (req, res) => res.json({ status: 'healthy' }));
app.get('/ready', async (req, res) => {
  try { await db.ping(); res.json({ status: 'ready' }); }
  catch { res.status(503).json({ status: 'not ready' }); }
});

// 5. Docker
// FROM node:20-alpine
// RUN adduser -S appuser && USER appuser
// HEALTHCHECK CMD node health.js

// 6. Input validation
const { body, validationResult } = require('express-validator');
app.post('/api/users', body('email').isEmail(), handler);