// ❌ WRONG — API key in source code
const API_KEY = 'a1b2c3d4e5f6g7h8';

// ✅ CORRECT — Load from environment variables
const API_KEY = process.env.RAPIDAPI_KEY;
if (!API_KEY) {
  throw new Error('RAPIDAPI_KEY environment variable is required');
}

# .gitignore — ALWAYS include these
.env
.env.local
.env.production
*.key
*.pem

// key-rotation.js — Rotate API keys without downtime
class APIKeyManager {
  constructor() {
    this.primaryKey = process.env.RAPIDAPI_KEY_PRIMARY;
    this.fallbackKey = process.env.RAPIDAPI_KEY_FALLBACK;
  }
  
  async makeRequest(endpoint, body) {
    try {
      return await this.callAPI(endpoint, body, this.primaryKey);
    } catch (error) {
      if (error.status === 401 || error.status === 403) {
        console.warn('Primary key failed, trying fallback...');
        return await this.callAPI(endpoint, body, this.fallbackKey);
      }
      throw error;
    }
  }
  
  async callAPI(endpoint, body, key) {
    const response = await fetch(
      `https://whatsapp-messaging-bot.p.rapidapi.com${endpoint}`,
      {
        method: 'POST',
        headers: {
          'Content-Type': 'application/json',
          'X-RapidAPI-Key': key,
          'X-RapidAPI-Host': 'whatsapp-messaging-bot.p.rapidapi.com',
        },
        body: JSON.stringify(body),
      }
    );
    
    if (!response.ok) {
      const error = new Error(`API error: ${response.status}`);
      error.status = response.status;
      throw error;
    }
    
    return await response.json();
  }
}

// webhook-security.js
const crypto = require('crypto');

const WEBHOOK_SECRET = process.env.WEBHOOK_SECRET;

function validateWebhook(req, res, next) {
  const signature = req.headers['x-webhook-signature'];
  const timestamp = req.headers['x-webhook-timestamp'];
  
  // Reject requests older than 5 minutes (prevent replay attacks)
  const age = Date.now() - parseInt(timestamp, 10);
  if (age > 5 * 60 * 1000) {
    return res.status(401).json({ error: 'Webhook too old' });
  }
  
  // Verify signature
  const payload = `${timestamp}.${JSON.stringify(req.body)}`;
  const expected = crypto
    .createHmac('sha256', WEBHOOK_SECRET)
    .update(payload)
    .digest('hex');
  
  if (!crypto.timingSafeEqual(Buffer.from(signature || ''), Buffer.from(expected))) {
    console.warn('⚠️ Invalid webhook signature');
    return res.status(401).json({ error: 'Invalid signature' });
  }
  
  next();
}

const rateLimit = require('express-rate-limit');

const webhookLimiter = rateLimit({
  windowMs: 60 * 1000, // 1 minute
  max: 100, // max 100 webhook calls per minute
  message: { error: 'Too many webhook calls' },
});

app.post('/webhook/whatsapp', webhookLimiter, validateWebhook, handleWebhook);

// Redirect HTTP to HTTPS
app.use((req, res, next) => {
  if (req.headers['x-forwarded-proto'] !== 'https' && process.env.NODE_ENV === 'production') {
    return res.redirect(301, `https://${req.hostname}${req.url}`);
  }
  next();
});

// encryption.js
const crypto = require('crypto');

const ENCRYPTION_KEY = process.env.ENCRYPTION_KEY; // 32-byte key
const IV_LENGTH = 16; // AES block size

function encrypt(text) {
  const iv = crypto.randomBytes(IV_LENGTH);
  const cipher = crypto.createCipheriv('aes-256-cbc', Buffer.from(ENCRYPTION_KEY, 'hex'), iv);
  let encrypted = cipher.update(text, 'utf8', 'hex');
  encrypted += cipher.final('hex');
  return iv.toString('hex') + ':' + encrypted;
}

function decrypt(encryptedText) {
  const parts = encryptedText.split(':');
  const iv = Buffer.from(parts[0], 'hex');
  const decipher = crypto.createDecipheriv('aes-256-cbc', Buffer.from(ENCRYPTION_KEY, 'hex'), iv);
  let decrypted = decipher.update(parts[1], 'hex', 'utf8');
  decrypted += decipher.final('utf8');
  return decrypted;
}

// Usage: encrypt message content before storing
const encryptedMessage = encrypt('Hello, this is a sensitive message');
const originalMessage = decrypt(encryptedMessage);

-- PostgreSQL: Store encrypted phone numbers and messages
CREATE TABLE whatsapp_messages (
  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
  phone_number_encrypted TEXT NOT NULL, -- Encrypted with AES-256
  message_encrypted TEXT NOT NULL,
  direction VARCHAR(10) NOT NULL, -- 'inbound' or 'outbound'
  created_at TIMESTAMPTZ DEFAULT NOW(),
  expires_at TIMESTAMPTZ -- For automatic deletion
);

-- Create index on non-sensitive fields only
CREATE INDEX idx_messages_direction ON whatsapp_messages(direction);
CREATE INDEX idx_messages_created_at ON whatsapp_messages(created_at);

// consent-manager.js
const consentStore = new Map(); // In production, use a database

async function recordConsent(phoneNumber, consentType) {
  const consent = {
    phoneNumber,
    consentType, // 'marketing', 'transactional', 'support'
    grantedAt: new Date().toISOString(),
    ipAddress: null, // Don't store IP for WhatsApp consent
    method: 'whatsapp_opt_in', // How consent was obtained
    version: '1.0', // Privacy policy version
  };
  
  consentStore.set(`${phoneNumber}:${consentType}`, consent);
  
  // Log consent event for audit
  await logAuditEvent('consent_granted', consent);
  
  return consent;
}

async function revokeConsent(phoneNumber, consentType) {
  consentStore.delete(`${phoneNumber}:${consentType}`);
  
  await logAuditEvent('consent_revoked', { phoneNumber, consentType });
}

function hasConsent(phoneNumber, consentType) {
  return consentStore.has(`${phoneNumber}:${consentType}`);
}

// Check consent before sending ANY marketing message
async function sendMarketingMessage(phone, text) {
  if (!hasConsent(phone, 'marketing')) {
    console.warn(`⚠️ No marketing consent for ${phone}`);
    return { error: 'No consent' };
  }
  
  // Proceed with sending
  return await sendWhatsAppMessage(phone, text);
}

async function handleDeletionRequest(phoneNumber) {
  console.log(`🗑️ Processing deletion request for ${phoneNumber}`);
  
  // 1. Delete all messages
  await db.query(
    'DELETE FROM whatsapp_messages WHERE phone_number_encrypted = $1',
    [encrypt(phoneNumber)]
  );
  
  // 2. Delete consent records
  for (const type of ['marketing', 'transactional', 'support']) {
    consentStore.delete(`${phoneNumber}:${type}`);
  }
  
  // 3. Delete from CRM
  await deleteCRMContact(phoneNumber);
  
  // 4. Log the deletion (keep audit log, as GDPR permits)
  await logAuditEvent('data_deletion', {
    phoneNumber: hashPhoneNumber(phoneNumber), // Store hash only
    deletedAt: new Date().toISOString(),
    reason: 'user_request',
  });
  
  // 5. Confirm deletion to user
  await sendWhatsAppMessage(phoneNumber,
    'Your data has been deleted as requested. You will no longer receive messages from us. This is the final message.'
  );
  
  console.log(`✅ Deletion complete for ${phoneNumber}`);
}

function hashPhoneNumber(phone) {
  return crypto.createHash('sha256').update(phone).digest('hex').slice(0, 16);
}

// retention-policy.js
const RETENTION_DAYS = {
  transactional: 90,  // Order confirmations, receipts
  marketing: 30,      // Promotional messages
  support: 180,       // Customer support conversations
  otp: 1,             // One-time passwords
};

// Scheduled cleanup job (run daily)
async function cleanupExpiredMessages() {
  for (const [type, days] of Object.entries(RETENTION_DAYS)) {
    const cutoff = new Date();
    cutoff.setDate(cutoff.getDate() - days);
    
    const result = await db.query(
      `DELETE FROM whatsapp_messages 
       WHERE message_type = $1 AND created_at < $2
       RETURNING id`,
      [type, cutoff]
    );
    
    console.log(`🗑️ Deleted ${result.rowCount} expired ${type} messages`);
  }
}

// Schedule: run daily at 3 AM
const cron = require('node-cron');
cron.schedule('0 3 * * *', cleanupExpiredMessages);

// audit-logger.js
async function logAuditEvent(eventType, data) {
  const event = {
    id: crypto.randomUUID(),
    timestamp: new Date().toISOString(),
    eventType,
    data: {
      ...data,
      // Hash sensitive fields
      phoneNumber: data.phoneNumber
        ? hashPhoneNumber(data.phoneNumber)
        : undefined,
    },
    environment: process.env.NODE_ENV,
    service: 'whatsapp-api',
  };
  
  // Store in append-only audit log
  await db.query(
    `INSERT INTO audit_log (id, timestamp, event_type, data, environment, service)
     VALUES ($1, $2, $3, $4, $5, $6)`,
    [event.id, event.timestamp, event.eventType, JSON.stringify(event.data), event.environment, event.service]
  );
  
  return event;
}

// Events to log:
// - message_sent: outbound message sent
// - message_received: inbound message received
// - session_created: new WhatsApp session
// - session_terminated: session ended
// - consent_granted: user opted in
// - consent_revoked: user opted out
// - data_deletion: user data erased
// - api_key_rotated: API key changed
// - rate_limit_exceeded: abuse detected
// - webhook_validation_failed: potential tampering

CREATE TABLE audit_log (
  id UUID PRIMARY KEY,
  timestamp TIMESTAMPTZ NOT NULL,
  event_type VARCHAR(50) NOT NULL,
  data JSONB NOT NULL,
  environment VARCHAR(20) NOT NULL,
  service VARCHAR(50) NOT NULL
);

-- Index for queries
CREATE INDEX idx_audit_timestamp ON audit_log(timestamp);
CREATE INDEX idx_audit_event_type ON audit_log(event_type);

-- Prevent modifications (append-only)
REVOKE UPDATE, DELETE ON audit_log FROM app_user;

// rate-limiter.js
const Redis = require('ioredis');
const redis = new Redis(process.env.REDIS_URL);

async function checkRateLimit(phoneNumber, maxPerHour = 10) {
  const key = `ratelimit:${hashPhoneNumber(phoneNumber)}`;
  const count = await redis.incr(key);
  
  if (count === 1) {
    await redis.expire(key, 3600); // 1 hour window
  }
  
  if (count > maxPerHour) {
    console.warn(`⚠️ Rate limit exceeded for ${phoneNumber}: ${count}/${maxPerHour}`);
    await logAuditEvent('rate_limit_exceeded', { phoneNumber });
    return false;
  }
  
  return true;
}

// Usage before sending
async function safeSendMessage(phone, text) {
  const allowed = await checkRateLimit(phone);
  if (!allowed) {
    return { error: 'Rate limit exceeded. Please try again later.' };
  }
  
  return await sendWhatsAppMessage(phone, text);
}