Security

// Use least privilege principle
const apiKey = process.env.STICKER_API_KEY;

// Only backend services should have access
if (typeof window !== 'undefined') {
  throw new Error('API key cannot be accessed in browser');
}

// Good
const API_URL = 'https://api.usesticker.com/v1';

// Bad - never use HTTP
const API_URL = 'http://api.usesticker.com/v1'; // ❌

function validateOrganization(org) {
  const errors = [];
  
  // Email validation
  if (!org.email || !/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(org.email)) {
    errors.push('Invalid email format');
  }
  
  // Required fields
  if (!org.name || org.name.trim().length === 0) {
    errors.push('Organization name is required');
  }
  
  // State validation
  const validStates = ['AL', 'AK', 'AZ', /* ... all states */];
  org.shippingLocations?.forEach((loc, idx) => {
    if (!loc.address.province) {
      errors.push(`Address ${idx + 1} is missing state`);
    }
  });
  
  return errors;
}

class RateLimiter {
  constructor(maxRequests, windowMs) {
    this.maxRequests = maxRequests;
    this.windowMs = windowMs;
    this.requests = [];
  }

  async throttle() {
    const now = Date.now();
    
    // Remove old requests outside window
    this.requests = this.requests.filter(
      time => now - time < this.windowMs
    );
    
    // Check if at limit
    if (this.requests.length >= this.maxRequests) {
      const oldestRequest = this.requests[0];
      const waitTime = this.windowMs - (now - oldestRequest);
      await new Promise(resolve => setTimeout(resolve, waitTime));
      return this.throttle();
    }
    
    // Add this request
    this.requests.push(now);
  }
}

// Usage
const limiter = new RateLimiter(100, 60000); // 100 per minute

async function callAPI(endpoint, data) {
  await limiter.throttle();
  return fetch(endpoint, data);
}

<iframe
  src="https://shop.usesticker.com/embedded/{partner_id}?session_key=..."
  sandbox="allow-same-origin allow-scripts allow-forms allow-popups allow-popups-to-escape-sandbox allow-top-navigation-by-user-activation"
  allow="payment; publickey-credentials-get; fullscreen"
/>

Content-Security-Policy:
  default-src 'self';
  frame-src https://shop.usesticker.com https://*.usesticker.com;
  connect-src 'self' https://api.usesticker.com;

// Good - token in URL parameter (over HTTPS)
const iframeSrc = `https://shop.usesticker.com/embedded/${partnerId}?session_key=${token}`;

// Bad - never put in localStorage accessible to other scripts
localStorage.setItem('sticker_token', token); // ❌

// Generate fresh token for each session
async function openSuppliesModule(userId) {
  // 1. Generate new token
  const { session_key, iframe_embed_url, expires_at } = await handshake(userId);
  
  // 2. Use immediately (don't store)
  renderIframe(iframe_embed_url);
  
  // 3. Token is consumed on first use
  // 4. If user closes and reopens, generate new token
}

function prepareUserData(user) {
  // Only send necessary fields
  return {
    firstName: user.firstName,
    lastName: user.lastName,
    email: user.email,
    phoneNumber: user.phone  // Optional
    // Don't send: SSN, DOB, medical records, passwords, etc.
  };
}

function logSecurityEvent(event, severity, details) {
  const securityLog = {
    timestamp: new Date().toISOString(),
    event: event,
    severity: severity,
    details: details
  };
  
  // Send to your logging system
  logger.log(securityLog);
  
  // Alert on critical events
  if (severity === 'critical') {
    alertSecurityTeam(securityLog);
  }
}

// Example usage
logSecurityEvent('api_key_exposed', 'critical', {
  message: 'API key found in client-side code',
  file: 'app.js'
});

class AnomalyDetector {
  trackRequest(userId, success) {
    // Track error rates per user
    const userErrors = this.getErrorCount(userId);
    
    if (!success) {
      this.incrementErrorCount(userId);
      
      // Alert on high error rate
      if (userErrors > 10) {
        this.alert('High error rate', { userId, errors: userErrors });
      }
    }
  }
}